36C10B25Q0022.docx

SUBJECT*

Performance Oversight and Access Reporting (POAR) Software as a Service (SaaS) (VA-25-00012049)

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Erica Wortman Erica.Wortman@va.gov

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

Sources Sought Notice Sources Sought Notice

DESCRIPTION

Sources Sought Notice

Department of Veterans Affairs (VA) Veterans Health Administration (VHA) Integrated Veteran Care (IVC)

Request for Information (RFI)

Performance Oversight and Access Reporting (POAR) Software as a Service (SaaS)

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY (as defined in Federal Acquisition Regulation (FAR) 15.201(e)), and shall not be considered an Invitation for Bids, Request for Quotations, or a Request for Proposal. Do not submit a proposal or quote. This market research is issued for information and planning purposes only and does not constitute a solicitation nor does it restrict the Government as to the ultimate acquisition approach. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. Any contract that might be awarded based on information received or derived from this market research will be the outcome of a competitive process. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

Be advised that set-aside decisions may be made based on the information provided in response to this RFI. Responses should be as complete and informative as possible. The North American Industry Classification System (NAICS) for this requirement is 541519 with a size standard of 150 employees. A company that is a Service-Disabled Veteran-Owned Small Business (SDVOSB) or a Veteran-Owned Small Business (VOSB) must be VetCert registered and verified (https://veterans.certify.sba.gov).

The purpose of this RFI is to conduct market research to obtain information pertaining to industry capabilities and commercially available solutions for Performance Oversight and Access Reporting (POAR) Software as a Service (SaaS).

1. VA is seeking input on potential solutions and requesting the capabilities and experience from industry partners interested in contributing to the solution or providing these services for VA. Businesses of all sizes are encouraged to respond. The Government requests that contractors respond to the specific questions provided in this Request for Information. Responses should “demonstrate” capability, not just “confirm” the company’s belief that the capability exists.

2. The agency does not intend to award a contract as a result of this RFI, but rather gather capabilities and market information pertinent for project and acquisition planning. The responses to this RFI will be captured as market research and may contribute to the development of an acquisition strategy. Information provided may be used to assess tradeoffs and alternatives available for the potential requirement and may lead to the development of a solicitation. All submissions become Government property and will not be returned. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate.

The information provided in the RFI is subject to change and is not binding on the Government.

Any organization responding to this notice should ensure that its response is complete and sufficiently detailed.

PURPOSE

This Request for Information (RFI) is for Market Research Only.

BACKGROUND

The Department of Veterans Affairs (VA) is the largest clinically integrated health system in the Nation, providing access to medical care for approximately nine million enrolled Veterans. The Veteran Health Administration (VHA) Integrated Veteran Care (IVC) leads operational functions to ensure the care provided to Veterans by community providers is scheduled, accessed, and paid for in a timely manner. To ensure that all patients have adequate access to timely, high-quality, specialized care, VA continues to deploy modernization efforts and clinical care innovations to maximize care efficiency without jeopardizing quality or access.

VA is seeking services to configure a Software as a Service (SaaS) tool to provide VHA IVC a comprehensive resource for automated analytical reporting leveraged across multiple levels of the VA organization, to improve the monitoring, management, and oversight of health care purchased outside of VA Medical Centers (VAMC) through the Veterans Community Care Programs (VCCP).

EXISTING APPLICATIONS

VA has multiple data sources to include, (but not limited to) EDI Claims (837I, 837P, 837D, 835), Corporate Data Warehouse, Financial Service Center and Electronic Claims Administration and Management System (eCAMS), which will need to continue to be utilized as sources for data gathering/mining.

DESIRED END STATE

· VA is seeking a dashboard and reporting system that has the capacity to configured and subsequently maintained which will contain categorized reports aligning to the following dashboard titles: Network Management (NM) and Administrative Fees Oversight (Admin Fee).

· Network Management dashboard reports consist of key elements to monitor Network Adequacy, Veteran Access, and Provider Utilization.

· Administrative Fee Oversight dashboard reports focus on Contract Performance Monitoring, monitoring Per Member Per Month (PMPM) fees and utilization as well as contract Incentive/Disincentive Factors (IDF) for the Community Care Network (CCN) Contracts.

· Reports developed shall include multiple data sources, as defined by VA during report development, and shall include retroactive reporting ensuring at least six (6) rolling years of reporting is housed within the dashboards.

· Reports developed shall provide various filtering and sorting abilities and shall also allow for geographic mapping display, when applicable as defined by VA.

· Reports developed as a part of the creation of the dashboard shall meet, but not be limited to, the following minimum requirements:

a. Allow VHA IVC to monitor and analyze the access to care within the CCN (Community Care Network) in relation to the calculated timeframes between various date stamped data elements. Wait time calculations will be processed utilizing CC referral and claims data with the resulting outputs extracted into custom Network Management reports that allow end users to analyze CCN coverage at various granularities, including VA Medical Center (VAMC), Veterans Integrated Service Network (VISN), and VA Enterprise level.

b. Allow VHA IVC to monitor and analyze the physical coverage of the CCN (Community Care Network) in proximity to Veteran locations and across medical specialties. Drive time calculations will be processed utilizing CC provider and Veteran location with the resulting outputs extracted into custom Network Management reports that allow end users to analyze and visualize CCN coverage at various granularities including at a Medical Center, VISN & Enterprise level.

c. This capability shall also include National Council for Prescription Drugs Programs (NCPDP) transactions to calculate pharmacy drive times and identifying the closest Immediate Need Pharmacy. Drive time calculations will be processed utilizing CC provider and Veteran location with the resulting outputs extracted into custom Network Management reports that allow end users to analyze CCN coverage at various granularities, including Medical Center, VISN & Enterprise level.

d. Allow VHA IVC to monitor and analyze the utilization of providers across VCCP through the analysis of network status and referral volumes. Utilization will be displayed including percentage comparisons and visuals that allow end users to analyze CCN coverage at various granularities, including Medical Center, VISN & Enterprise level.

e. Allow VHA IVC to monitor and analyze a visual representation of approved network waivers (Deviations) across multiple provider specialties and categories of care spatially compared to approved counties and zip codes.

f. Allow VHA IVC to analyze and monitor Quality Assurance Surveillance Plan (QASP) Performance Objective (PO) calculations of the CCN contracts. These reports incorporate Network Dashboard calculations for wait time and drive time as well as analysis of claims processing, scheduling times, as well as other quality metrics.

g. Allow VHA IVC to monitor and analyze up to a full year of CCN Per Member Per Month (PMPM)/Per Member Per Case (PMPC) budgetary requirements across the unique Veteran and total expenditure measure selection. Data incorporated into this include Invoice Payment Processing System (IPPS) data when it is available and admin fee projections (leveraging historical claims and referral data) when actual information is not available. The resulting outputs extracted into custom Admin Fee reports will allow end users to drill-down and analyze raw data by respective PMPM/PMPC category, CCN region, and fiscal year.

h. Allow VHA IVC to monitor and analyze detailed information on the Incentives (or disincentives) that are paid (or billed) to the CCN Third Party Administrators (TPAs) for their performance in supporting CCN and its various initiatives. This report shall project the feasible range of outcomes for any given IDF, region, and future fiscal year, it also incorporates actual Quality Assurance Surveillance Plan (QASP) Performance Objective (PO), TPA 837/835 Electronic Data Interchange (EDI), Provider Profile Management System (PPMS), and TPA improper payment audit deliverable data to calculate the specific outcomes and cost impacts for IDFs 1 – 5 by region and fiscal year.

· The underlying and supporting system housing and displaying these reports shall meet the following minimum requirements:

a. Be FEDRAMP MODERATE authorization and validation through FEDRAMP Marketplace with the ability to move to the High Impact Level should the need arise. This shall apply to both the SaaS and any cloud hosting service/infrastructure. Shall be FIPS 140- 2, NIST 800, HIPAA, and 508 Compliant.

b. Run on a secure cloud infrastructure and shall be accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email) or a program interface.

c. Not require download of software to VA computers.

d. Not require VA to manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or individual application capabilities.

e. Be accessible to multiple simultaneous VA users at any given time. The number of user accounts that could be accessed simultaneously by users of this software is estimated at 500 users.

f. Be able to support the estimated up to 50 million claims per year with storage capacity that includes the current fiscal year as well as six (6) prior fiscal years.

g. Include data objects that shall be editable with the support of Data Authoring and Versioning (DAV) control.

h. The Contractor shall ensure the POAR SaaS tool is available and operational for users 24/7.

i. System shall have or achieve an Enterprise-wide (VA-wide) Authority to Operate

j. System shall support VA trusted internet connection (TIC)

k. System shall be accessible both within VA facilities and remotely

l. System shall be a configurable Commercial-off-the-shelf (COTS) SaaS product

m. System shall enable direct Single-Sign-On (SSO) through integration with VA’s SSOe

n. System shall have adaptable integration options to support integrations with future VA systems

o. System shall allow for integration with current and future COTS software and analytical tools utilized by VA, including but not limited to Tableau, MS Power BI, Service Now

p. VA Users shall be able to appropriately export information from the system, consistent with VA security and privacy requirements (User Role access or other solutions to restrict access to protect PII)

q. System shall facilitate role-based user access and authorization

r. System shall be able to provide continuous release capability

s. System shall be able to offer Application Program Interfaces (APIs) that can be consumed by VA systems, e.g., VA.GOV

t. System shall maintain capacity to have data refreshed and validated monthly

u. Provide unlimited end user access to POAR SaaS solution via a secure website.

INSTRUCTIONS FOR RESPONDING TO THIS RFI

CONFIDENTIALITY: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

Response Format/Page Limitations:

The overall total page limit for responses to this RFI is five (5) pages. Responses should be submitted in Microsoft Word format with Times New Roman font, 12 pt. minimum that addresses the above information. Interested parties should limit marketing material to allow sufficient space for adequately, directly, and substantively responding with the information of most interest to the Government.

In all correspondence relevant to this RFI please identify it as a response to the VA-25-00012049 POAR SaaS (Response and Subject Line of email)

Any organization responding to this notice should ensure that its response is complete and sufficiently detailed. Respondents are requested to limit responses to the information, and in the format provided below.

A - GENERAL INFORMATION

A1. Organization Name and the year in which the company was established / founded (please list any previous names used).

a. Unique Entity ID:

b. Address:

c. Point of Contact:

d. Phone Number:

e. Fax Number:

f. Email Address:

g. Any applicable schedules (General Services Administration (GSA), Mission Oriented Business Integrated Services (MOBIS), Veterans Technology Services (VETS) Government wide Acquisition Contract (GWAC), etc.):

h. Business size status based upon the applicable NAICS code of 541519 Other Computer Related Services. (For more information refer to http://www.sba.gov/):

i. If SDVOSB/VOSB, is your business verified in the VetCert database (https://veterans.certify.sba.gov)

A2. Company ownership (public, private, joint venture).

B – APPROACH, CAPABILITY, AND EXPERIENCE INFORMATION

B1. Describe how your company, partner or sub-contractor’s solution qualifies as a VA Software as a Service (SaaS) and describe its hosting environment.

a. How does/will your company, partner or sub-contractor’s solution meet requirements for VA FedRamp approval at the software and hosting level?

Submission: Responses to this RFI shall be submitted to the following points of contact via email to Erica.Wortman@va.gov and Michael.Marone@va.gov no later than at 1:00PM ET on Wednesday, October 16, 2024.

Questions: Questions related to this RFI and/or the draft PD shall be submitted on, or before 1:00PM ET on Thursday, October 11, 2024. Submit questions, in writing, regarding this RFI to Erica.Wortman@va.gov and Michael.Marone@va.gov.

See attached documents:

“Draft – PWS Performance Oversight and Access Reporting (POAR) Software as a Service (SaaS)”

Page 1 of

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Engineering (PE)

Veteran Health Administration (VHA), Integrated Veteran Access Integrated Veteran Care (IVC) Performance Oversight and Access Reporting (POAR) Software as a Service (SaaS) Date: October 8, 2024

VA-25-00012049

PWS Version Number: 2.0

Contents

1.0 BACKGROUND

The Department of Veterans Affairs (VA) is the largest clinically integrated health system in the Nation, providing access to medical care for approximately nine million enrolled Veterans. The Veteran Health Administration (VHA) Integrated Veteran Care (IVC) leads operational functions to ensure the care provided to Veterans by community providers is scheduled, accessed, and paid for in a timely manner. To ensure that all patients have adequate access to timely, high-quality, specialized care, VA continues to deploy modernization efforts and clinical care innovations to maximize care efficiency without jeopardizing quality or access.

VA is seeking services to configure a Software as a Service (SaaS) tool on a GovCloud platform to provide VHA IVC a comprehensive resource for automated analytical reporting leveraged across multiple levels of the VA organization, to improve the monitoring, management, and oversight of health care purchased outside of VA Medical Centers (VAMC) through the Veterans Community Care Programs (VCCP).

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

3.0 SCOPE OF WORK

The Contractor shall provide configuration, maintenance and sustainment of a Performance Oversight and Access Reporting System (POAR) SaaS Solution that provides data visualization and reporting mechanisms that integrates financial management, medical management and data analytics to predict, forecast, and analyze the availability of healthcare services leveraged by veterans through VCCP as well as allows VHA IVC the ability to monitor, oversee, and analyze financial and performance aspects of the Community Care Network (CCN) contracts. The Contractor shall provide dashboard and report development and data architecture professional services to ensure dashboards and respective reports aligned within are designed and created to meet exact calculation and display criteria outlined by VHA IVC Subject Matter Experts. Work accomplished and the underlying SaaS system offered shall be focused to provide accurate and efficient solutions in support of VHA requirements to improve reporting, analysis, and oversight of care rendered through VCCP.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

This effort shall have a 12-month base period of performance, with two 12-month option periods for continued access to the POAR SaaS tool subscriptions. In addition, this procurement includes up to two optional tasks for additional POAR SaaS licenses, which may be required throughout the period of performance.

4.2 PLACE OF PERFORMANCE

Efforts under this contract shall be performed at contractor facilities. The contractor shall identify the contractor’s place of performance.

4.3 TRAVEL

Efforts under this contract shall be performed at contractor facilities. The contractor shall identify the contractor’s place of performance. Travel is not authorized under this contract.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 REPORT DEVELOPMENT AND SYSTEM CONFIGURATION SERVICES

The Contractor shall provide professional services to include dashboard and report development as well as data architecture support to build and maintain two dashboards containing categorized reports aligning to the following dashboard titles: Network Management (NM) and Administrative Fees Oversight (Admin Fee). Network Management dashboard reports consist of key elements to monitor Network Adequacy, Veteran Access, and Provider Utilization. Administrative Fee Oversight dashboard reports focus on Contract Performance Monitoring, monitoring Per Member Per Month (PMPM) fees and utilization as well as contract Incentive/Disincentive Factors (IDF) for the Community Care Network (CCN) Contracts.

Reports developed shall include multiple data sources, as defined by VA during report development, and shall include retroactive reporting ensuring at least six (6) rolling years of reporting is housed within the dashboards. NM and Admin Fee dashboards shall be created and published within the SaaS system no later than thirty (30) days from data availability in accordance with the Data Transition Plan (see section 5.1.2).

5.1.1 DASHBOARD AND REPORT DEVELOPMENT

The Contractor shall develop and maintain reports within the Network Management dashboard throughout the period of performance to predict, forecast, and analyze the availability of healthcare services to assess Network Adequacy. Reports within the NM dashboard shall allow the Government to review relevant referral and claims data that identifies the location of most required healthcare services in conjunction with the available providers of the same healthcare services within the CCN Third Party Administrator (TPA) network and Veteran Care Agreements (VCAs), while also populating other available providers in the geographic market by utilizing the CMS NPI database of all providers across the county.

Veteran demographics must be overlaid on the community care provider network and other non-CCN available providers to determine if services are available within veteran communities. Available services shall be determined based on drive times from Veteran addresses and shall be reportable based on type of care and specialty of the providers utilizing MS Azure mapping Application Programming Interface (API) to provide the necessary data elements needed by the Government.

Reports developed as a part of the creation of the dashboard shall meet, but not be limited to, the following minimum requirements:

a. Allow VHA IVC to monitor and analyze the access to care within the CCN (Community Care Network) in relation to the calculated timeframes between various date stamped data elements. Wait time calculations shall be processed utilizing CC referral and claims data with the resulting outputs extracted into custom Network Management reports that allow end users to analyze CCN coverage at various granularities, including VA Medical Center (VAMC), Veterans Integrated Service Network (VISN), and VA Enterprise level.

b. Allow VHA IVC to monitor and analyze the physical coverage of the CCN (Community Care Network) in proximity to Veteran locations and across medical specialties. Drive time calculations shall be processed utilizing CC provider and Veteran location with the resulting outputs extracted into custom Network Management reports that allow end users to analyze and visualize CCN coverage at various granularities including at a Medical Center, VISN & Enterprise level.

c. This capability shall also include National Council for Prescription Drugs Programs (NCPDP) transactions to calculate pharmacy drive times and identifying the closest Immediate Need Pharmacy. Drive time calculations shall be processed utilizing CC provider and Veteran location with the resulting outputs extracted into custom Network Management reports that allow end users to analyze CCN coverage at various granularities, including Medical Center, VISN & Enterprise level.

d. Allow VHA IVC to monitor and analyze the utilization of providers across VCCP through the analysis of network status and referral volumes. Utilization shall be displayed including percentage comparisons and visuals that allow end users to analyze CCN coverage at various granularities, including Medical Center, VISN & Enterprise level.

e. Allow VHA IVC to monitor and analyze a visual representation of approved network waivers (Deviations) across multiple provider specialties and categories of care spatially compared to approved counties and zip codes.

The contractor shall develop and maintain reports within the Administrative Fees Oversight (Admin Fee) dashboard throughout the period of performance that manage, track, and monitor all CCN admin fees for the purposes of supporting budget formulation and decision-making processes. The Admin Fee Reports provide actual expenditures, referrals, claims, per member per month (PMPM), per member per case (PMPC) episodes, and Incentive/Disincentive Factors (IDFs). These reports allow the Government to review relevant CCN data to formulate the yearly Incentive/Disincentive, PMPM/PMPC monthly unique veteran count, and the monthly and annual expenditure counts by CLIN, which provides VA staff detailed information used to start IDF calculations. Unique Veteran and total expenditure data shall be parsed according to CCN region and aggregated monthly. This report incorporates data from Invoice Payment Processing System (IPPS) data and Financial Management System (FMS) to validate what is processed. Incentive/Disincentive Factors (IDF) offers information pertaining to the six (6) CCN Incentive, Disincentive Factors (IDFs) across CCN Regions. More specifically, users can customize reports to view outputs by respective IDF, IDF aggregation (i.e., IDF Fee Only or IDF Fee + PMPM Actuals) and FY to understand the feasible range of IDF outcomes to be expected. Reports shall be developed at the direction of VA staff and shall meet, but not be limited to, the following minimum requirements:

a. Allow VHA IVC to analyze and monitor Quality Assurance Surveillance Plan (QASP) Performance Objective (PO) calculations of the CCN contracts. These reports incorporate Network Dashboard calculations for wait time and drive time as well as analysis of claims processing, scheduling times, as well as other quality metrics.

b. Allow VHA IVC to monitor and analyze up to a full year of CCN Per Member Per Month (PMPM)/Per Member Per Case (PMPC) budgetary requirements across the unique Veteran and total expenditure measure selection. Data incorporated into this include Invoice Payment Processing System (IPPS) data when it is available and admin fee projections (leveraging historical claims and referral data) when actual information is not available. The resulting outputs extracted into custom Admin Fee reports shall allow end users to drill-down and analyze raw data by respective PMPM/PMPC category, CCN region, and fiscal year.

c. Allow VHA IVC to monitor and analyze detailed information on the Incentives (or disincentives) that are paid (or billed) to the CCN Third Party Administrators (TPAs) for their performance in supporting CCN and its various PWS initiatives. This report shall project the feasible range of outcomes for any given IDF, region, and future fiscal year, it also incorporates actual Quality Assurance Surveillance Plan (QASP) Performance Objective (PO), TPA 837/835 Electronic Data Interchange (EDI), Provider Profile Management System (PPMS), and TPA improper payment audit deliverable data to calculate the specific outcomes and cost impacts for IDFs 1 – 5 by region and fiscal year.

The contractor shall schedule meetings at a mutually agreed upon cadence to review exact report and dashboard specifications and review report outputs for accuracy. Report and dashboard availability within the broader system shall only be published at the approval of VA Program Manager/Business Owner.

Dashboards and correlated reports developed by the contractor shall be available in an ongoing capacity and shall be designed to ensure data parsed and automated by the contractor is updated within the reports at least monthly. Dashboards and reports will be inspected by VA independently from contractor data quality checks. Inspection results from VA will be leveraged to accept or reject corresponding deliverables.

Deliverables:

A. Network Management Dashboard with all corresponding reports B. Administrative Fee Dashboard with all corresponding reports

5.1.2 DATA AND SYSTEM CONFIGURATION

The Contractor shall provide data architecture support to configure and parse data to ensure accurate development of reports. Data configuration shall ensure automated processing of all VHA IVC Claims (837I, 837P, 837D, 835) through an EDI parser and applying business logic to filter using VHA inclusion criteria for claims to be compared to other VA data sources. VHA IVC currently leverages a legacy system, Advanced Medical Cost Management Solution (AMCMS) to parse raw data and display custom reports. Current data parsing methodology should be identically matched to ensure accurate and efficient data alignment with required reports.

The Contractor shall have a data transition plan in place within 5 business days from kick off meeting. Data transition is needed to convert current data parsing processes to align to receiving all VHA IVC claims post-parsing within 30 days of post-parsing data availability within POAR. The transition plan shall include details of the transition that accommodates a seamless transition to the Performance Oversight and Access Reporting module. Upon notice from the Government that the VHA IVC claims change shall take place from raw data to parsed data, the contractor shall enact the transition plan. The estimated number of claims and referrals to be processed in each option year is reflected below.

The Contractor shall utilize MS Azure Mapping to calculate drive time calculations in support of the Network Management Dashboards. Mapping shall be capable of matching addresses on a one-to-one and one-to-many structures to ensure flexibility in calculations. Mapping and Drive Time calculations shall be leveraged to assess not only exact drive times but forecast potential drive statistics. Estimated point-to-point calculations are in alignment with the estimated claims and referrals volumes outlined above. Claims and referral data processing shall occur at a minimum monthly interval and shall be refreshed at the time of report creation or realignment. MS Azure Mapping calculations shall occur monthly as part of the data processing. When report refresh and realignment occurs, the contractor shall utilize a cache to ensure that previous claims and referral data is being utilized and not being routed through Azure mapping a second time, to avoid additional costs.

The contractor shall conduct monthly Data Quality Checks corresponding to monthly data processing to ensure that all reports have been updated with current data and filters are working. Outcomes of monthly data quality checks shall be reported in the Monthly Progress Reports (see section 5.2.2). Data quality checks shall validate the following:

· Ensuring all Sources have been updated with current data.

· Confirm matching of referral and claims is logical and all EDI claims files have been received and accurately parsed.

· Assessment of data from previous months and comparison of monthly data to ensure completeness.

Deliverables:

A. Data Transition Plan

5.1.3 SOFTWARE AS A SERVICE

The contractor shall provide, update and maintain a reporting environment that delivers the VA with a Performance Oversight and Access Reporting (POAR) SaaS tool as the base operating system to support dashboard and reporting that enables IVC to visualize and analyze pre-defined and required dashboards for Network Management and Administrative Fee. The required SaaS tool shall include software subscriptions, maintenance, and support.

The POAR (SaaS) tool shall:

a. Be FEDRAMP MODERATE authorization and validation through FEDRAMP Marketplace with the ability to move to the High Impact Level should the need arise. This shall apply to both the SaaS and any cloud hosting service/infrastructure. Shall be FIPS 140- 2, NIST 800, HIPAA, and 508 Compliant.

b. Run on a cloud infrastructure and shall be accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email) or a program interface.

c. Not require download of software to VA computers.

d. Not require VA to manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or individual application capabilities.

e. Be accessible to multiple simultaneous VA users at any given time. The number of user accounts that could be accessed simultaneously by users of this software is estimated at 500 users.

f. Be able to support the estimated up to 50 million claims per year with storage capacity that includes the current fiscal year as well as six (6) prior fiscal years.

g. Include data objects that shall be editable with the support of Data Authoring and Versioning (DAV) control.

h. The Contractor shall ensure the POAR SaaS tool is available and operational for users 24/7.

The POAR SaaS tool shall meet all the following salient characteristics:

5.1.4 OPTIONAL TASK 1 (ONE) – ADDITIONAL POAR SAAS TOOL LICENSES

This optional task may be exercised at any time during the base and all option periods. If exercised, the Contractor shall provide, in increments of 500 and up to 1,000, additional Performance Oversight and Access Reporting SaaS tool licenses in accordance with the PWS.

5.2 PROJECT MANAGEMENT

5.2.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.2.2 REPORTING REQUIREMENTS

The Contractor shall provide progress reports for the POAR SaaS reporting suites and allow the VA to export these reports. The data shall be updated monthly, to include detailed instructions, and explanations for each required data element and to ensure that data is accurate and consistent.

Progress reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The reports shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. Reports shall also include an itemized list of all Information and Communication Technology (ICT) and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall keep in communication with VA to ensure that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverables:

A. Monthly Progress Reports

5.2.3 TECHNICAL KICK-OFF MEETING

The Contractor shall conduct a kick-off meeting with the VA PM, COR, CO, and Contract Specialist. The meeting shall be held within 5 business days after contract award. The kick-off meeting shall be virtual via MS Teams. The Contractor shall propose an agenda for VA COR approval three days prior to the meeting. The Contractor shall provide meeting minutes capturing discussion, agreements, and action items resulting from the kick-off meeting. The kick-off meeting shall address post award topics and shall present the Contractor’s draft plans and approach for meeting PWS requirements.

Deliverables:

A. Kick Off Meeting Agenda B. Kick Off Meeting Minutes

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

relies on VA user identities. MPI is the authoritative source for VA user identity data.

Level (AAL) appropriate for the solution.