36C10B25Q0125.docx

Fraud, Waste and Abuse (FWA) Software

VA-25-00032490

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Mr. Gary Howard E-mail: gary.howard3@va.gov Phone: (848) 377-5346

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

Sources Sought Notice Sources Sought Notice Please find all the pertinent information pertaining to this Request for Information (RFI) below.

Sources Sought Notice

REQUEST FOR INFORMATION (RFI)

INDRODUCTION: THIS IS NOT A SOLICITATION. This RFI is issued for information and planning purposes only, do not submit a proposal. There is no obligation for the Government to acquire any products or services described in this RFI. No funds have been authorized, appropriated, or received for this effort. The information provided may be used by the Department of Veterans Affairs (VA) in developing its acquisition strategy and Performance Work Statement (PWS). Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

BACKGROUND

The Department of Veterans Affairs (VA), Financial Services Center (FSC) adjudicates and pays healthcare claims from private providers outside of VA's medical facilities. The VA requires a tool or system that identifies and eliminates fraud, waste, and abuse during adjudication and processing of healthcare claims transactions.

QUESTIONS AND CRITICAL CONSIDERATIONS FOR INTERESTED CONTRACTORS

Responses are solely treated as information for the Government to consider. Direct or indirect costs incurred in response to this RFI are at the expense of the vendor, not the Government. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Any contract that might be awarded based on information received or derived from this RFI will be the outcome of a competitive process.

It is requested that all companies interested in participating in this effort to note their interest and respond to the areas identified in the “Capabilities Statement” and “General Questions” sections below. Provide a summary of your technical approach to meet each functional requirement Capabilities Statement The page limit for responses to this section is 12 pages.

1. Provide Point of Contact information (name, email address, address, telephone, and fax numbers).

2. Please identify your company’s size status based upon the applicable NAICS code of 541519. If in responding to this RFI, you believe another NAICS code should be applicable, please identify the NAICS code you consider appropriate for this effort along with detailed supporting rationale.

3. Please provide details regarding proposed joint ventures, teaming arrangements, strategic alliances or other business arrangements to satisfy requirements of the “Draft” Performance Work Statement (PWS). Small businesses are encouraged to identify teams whereby each team member is considered small business based upon the proposed North American Industrial Classification System (NAICS) code of 541519 (small business size standard of $27.5M average annual receipts) to support set-aside considerations.

4. Provide Fraud Waste and Abuse Software capabilities and deployment experience, to include both pre-payment and post-payment reviews.

5. Provide a brief summary of your technical approach to meet VA’s requirements in the attached “Draft” PWS. Identify any expected modifications that would be required to support the requirements detailed in the PWS.

6. Please provide whether your proposed solution will be a commercial-off-the-shelf system, or a system developed/customized for the VA.

7. Please provide a sample report of findings.

8. Proposed staffing plan to meet PWS requirements.

9. Ability to meet the timelines needed to successfully implement requirements set by the PWS.

10. Compensation Structure, Fee Schedule and Payment Methodologies

11. Provide a Rough Order of Magnitude.

12. Provide information if services and products are available under any Federal

13. Contract Vehicle, e.g., GWACs, GSA Federal Supply Schedule, T4NG, etc.

General Questions The page limit for responses in this section is 3 pages.

1. Please provide positive or negative feedback regarding the PWS, such as recommended changes, noted exceptions, ambiguities, etc.

2. Please identify any requirements that are significantly, and possibly unnecessarily, restricting.

RESPONSE SUBMISSION

Please submit responses via email to Gary Howard, Contract Specialist at gary.howard3@va.gov by 2:00 pm Easter Standard Time, January 29th, 2025. VA reserves the right to not reply to any emails, responses, and/or materials submitted.

See attached document: Draft PWS - Fraud Waste Abuse Detection Software.

DISCLAIMER

This RFI is issued solely for information and planning purposes only and does not constitute a solicitation. All information received in response to this RFI that is marked as proprietary will be handled accordingly. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI.

Fraud, Waste, and Abuse Detection Software

Page 1 of

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Financial Services Center (FSC) Financial Healthcare Services (FHS)

Fraud, Waste and Abuse (FWS) Software

Date: 12-9-2024

VA-25-00032490

PWS Version Number: 1.0

BACKGROUND

The Department of Veterans Affairs (VA), Financial Services Center (FSC) is authorized by the Government Management Reform Act of 1994 (Public Law 103-356) to provide common administrative support services on a reimbursable basis to VA and Other Government Agencies (OGA’s), as a Franchise Fund. The goals of the Franchise Fund organizations include:

The intent of this software requirement is to eliminate false claims. The False Claims Act (31 U.S.C. §3729), allows American citizens, whether affiliated with the government or not, to file actions against federal contractors claiming fraud against the government.

The False Claims Act was passed by Congress to prevent the United States Government from paying federal funds for fraudulent claims involving goods and services. For VA, this would include submitting false information in order to receive a higher reimbursement. Examples of this include upcoding (i.e., coding a higher DRG than the documentation support), lab unbundling (i.e., charging separately for procedures usually charged as one procedure), billing for services not actually rendered and duplicative billing.

The False Claims Act outlines the federal penalties for submitting false claims, as well as protections granted to an individual who reports a violation.

VA-FSC is measured on Return on Investment “ROI” of the FWA program. To improve the long-term ROI and align with FSC’s organizational goal, FWA software is being undertaken to enable more efficient processing. By investing in a FWA system, VA- FSC expects a range of benefits, including cost savings in operational IT infrastructures, improved cost recovery from administrative actions, and improved prevention and detection of fraud, waste and abuse in claims processing disbursements.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. American National Standards Institute (ANSI) Accredited Standards Committee (ASC) X12 Health Care Claim (837) Transaction Type 3 Technical Reports-TR3.

71. Medicare Claims Processing Manual, Publication 100-04, Chapter 23, and Medicare Claims Processing Manual, Publication 100-04, Chapter 12, Section 30.

SCOPE OF WORK

The Contractor shall provide commercial-off-the-shelf (COTS) software designed to detect Fraud, Waste and Abuse (FWA) and associated operational services to support the workload. VA-FSC requires a system that can be used to provide analytics that identifies billing patterns that might indicate potential fraud, waste and abuse. The Contractor shall enhance the system to meet evolving VA-FSC FWA business requirements and support the FSC’s healthcare claims adjudication enterprise solution, eCAMS HCE. The license provided by the Contractor shall be a perpetual license allowing unlimited use of the software product in perpetuity, as well as configuration, implementation, integration, testing, deployment of software, training, maintenance, and technical support. The Contractor, acting independently and not as an agent of the government, shall furnish all the necessary services, qualified personnel, material, equipment, supplies, and facilities except as otherwise specified herein, and otherwise do all things necessary for or incident to performance of requirements described in this work statement, also referred to as the Contractor’s Performance Work Statement (PWS).

PERFORMANCE DETAILS

1.1 PERFORMANCE PERIOD

The Contractor shall propose a configuration and implementation period of performance, not to exceed 2 years from the date of contract award. After software has been procured; configurations have been made, business rules have been incorporated, and the resulting software has been integrated with existing support systems and put into production; the FWA system will allow for real time FWA detection within claims adjudication process before payment of the claim as well as have the ability to conduct post-payment auditing/reviews. The configuration and implementation period will be followed by option periods of 12 months each, so that the overall contract period of performance does not exceed 5 years.

Base Period (NTE 24 months): Fraud, Waste and Abuse (FWA) Software Solution and Technical Support

Option Year 1 - Twelve (12) Month Period: Fraud, Waste and Abuse (FWA) Software Solution and Technical Support

Option Year 2 - Twelve (12) Month Period: Fraud, Waste and Abuse (FWA) Software Solution and Technical Support

Option Year 3 - Twelve (12) Month Period: Fraud, Waste and Abuse (FWA) Software Solution and Technical Support

Option Year 4 - Twelve (12) Month Period: Fraud, Waste and Abuse (FWA) Software Solution and Technical Support

When work is performed at a VA facility; contract personnel shall maintain a work schedule that coincides with the schedule of the VA-FSC organizations they support. Normal Federal Government workdays are between core hours of 0600 (6:00 AM) Central Time (CT) and 1800 (6:00 PM) CT.

On occasion, Contractor personnel may be required to provide services outside of normal hours of duty. When this happens, Contractor personnel shall comply with the VA-FSC's requirements. Contractor personnel shall not work during off-duty hours unless authorized in advance by the Contracting Officer's Representative (COR). The COR and the Contractor shall mutually agree upon all deviations to the schedule.

Any work at a Government site shall not take place on Federal holidays or weekends, unless directed by the Contracting Officer (CO). If required, the CO may authorize work during holidays and/or weekends. At a minimum, at least one Federal Government employee whose duties are relevant to the scope of this PWS must be present whenever Contract personnel perform work defined in this PWS at a VA facility.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

1.2 PLACE OF PERFORMANCE

Software procured under this contract shall be either a Software as a Service (SaaS) solution or installed in the VA-FSC facility in Austin, Texas; but will need to undergo configuration, implementation, integration, and testing to ensure it meets VA-FSC requirements, before it can be deployed into production. The Contractor shall identify the Contractor’s place of performance in their proposal submission. Work at the FSC government facility will be allowed as directed by FSC program management staff and/or the COR; however, no more than 10 contractor personnel will be authorized to work at the FSC facility.

1.3 TRAVEL

Costs for all travel associated performing the tasks outlined in this PWS is not authorized and will not be separately reimbursed by the government.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

1.4 PROJECT MANAGEMENT

1.4.1 CONTRACTOR PROJECT MANAGEMENT PLAN

During configuration and implementation of the software, the Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the tasks, sub-tasks, schedule and timelines, milestones, resource support, and risks. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The Contractor shall update and maintain the VA PM approved CPMP throughout the period of performance. The schedule and timelines shall be segregated by period, i.e. one initial one/two-year period plus each of three/four option periods, such that there is no overlap in periods for any scheduled activity, i.e. successful completion of work identified under any one period is not contingent on the exercise of any option period. The Contractor shall plan for 90-day period for VA testing to support production release and “go live” for each program offering. The Contractor shall update and maintain the VA Program Management approved CPMP, and submit the updated plan monthly, throughout the period of performance. The contractor shall submit the initial CPMP no later than 2 business days prior to the Post Award Orientation Conference (PAOC).

The monthly update to the CPMP shall cover all work completed during the month preceding the month during which the update is delivered, plus work planned for the month in which the update is delivered and any subsequent period within six months of the date of delivery. The update shall also identify any problems that arose and either a description of how the problems were resolved, or suggested resolutions, if problems were not resolved during the reporting period. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving each issue. The update shall also include any change in Contractor staff involved in the work identified in this PWS. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor is required to communicate problems and issues to the VA within three calendar days of discovery, to ensure issues identified on the report are transparent to both parties and to prevent escalation of outstanding issues.

This requirement will no longer be required once the software solution is implemented in production.

Deliverable Base Period:

A. Contractor Project Management Plan (Due two (2) business days prior to PAOC)

Deliverable Option Period 1:

A. Revised Contractor Project Management Plan if Required (Due 30 days prior to option period award)

5.1.2 TECHNICAL KICKOFF MEETING

The Contractor shall conduct a technical kickoff meeting within ten (10) days after contract award. The Contractor shall coordinate the date and time of a virtual meeting with the Contracting Officer (CO), VA PM, the Contract Specialist (CS), and the Contracting Officer Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. The Contractor shall prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the COR on the content of the meeting minutes prior to distribution of the document.

Deliverables Base Period:

A. Kickoff Meeting Agenda (within ten days after contract award) B. Kickoff Meeting Minutes (within ten days after Kickoff Meeting)

5.1.3 PRIVACY & HEALTH INSURANCE PORTABILITY AND ACCOUNTABIITY

ACT (HIPAA) TRAINING

The Contractor shall submit VA Talent Management System (TMS) training certificates of completion for 1) VA Privacy and Information Security Awareness and Rules of Behavior Training and 2) Health Insurance Portability and Accountability Act (HIPAA) training. The Contractor shall provide signed copies for each employee of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables Base Period:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate of Completion (Due upon completion) B. VA HIPAA Certificate of Completion (Due upon completion)

5.1.4 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic format, in Microsoft Word. The report shall include detailed explanations for each required data element, to ensure that data is accurate and consistent. This report shall reflect data through the last day of the preceding month.

The Monthly Progress Report shall cover all work completed during the month preceding the month during which the report is delivered, plus work planned for the month in which the report is delivered and any subsequent period within six months of the date of delivery. The report shall also identify any problems that arose and either a description of how the problems were resolved, or suggested resolutions, if problems were not resolved during the reporting period. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving each issue. The report shall also include an itemized list of all Electronic and Information Technology (EIT) deliverables and their current Section 508 conformance status. The report shall also include any change in Contractor staff involved in the work identified in this PWS. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor is required to communicate problems and issues to the VA within three calendar days of discovery, to ensure issues identified on the report are transparent to both parties and to prevent escalation of outstanding issues

Deliverable:

A. Monthly Progress Report (due one week after EOM)

5.1.5. POST AWARD ORIENTATION CONFERENCE (PAOC)

The Contractor shall participate (in person or virtual) in the PAOC at the VA-FSC in Austin, TX within seven calendar days after contract award, and cover the following information during the PAOC:

a. Details regarding Tasks, Subtasks, Timelines, and the Delivery Schedule for the Project Plan

b. Names and credentials for all Contractor resources who will participate in contract implementation (by Contractor)

c. Schedule for meetings with FSC Team members, Government counterparts to Contractor staff, Contractor staff, and Data Contacts resources.

The Contractor shall document the PAOC meeting minutes detailing what was discussed, list of attendees, expectations of Contractor, expectations of VA-FSC, and any actions required of each party.

Deliverable:

A. PAOC Meeting Minutes (Due within 7 calendar days after contract award)

5.1.6. PERPETUAL SOFTWARE PRODUCT/LICENSE

The Contractor shall provide a perpetual license for FWA software native to the FSC healthcare claims adjudication enterprise solution eCAMS HCE or as a stand-alone solution. The VA-FSC shall have unlimited use of the software product in perpetuity. The Government shall retain unlimited data rights for any software developed to meet the requirements of this contract. The FSC currently services a number of customers and as a Franchise organization; they have the ability to service additional customers with our healthcare claim processing product line. In order to enable and provide expansion capability, the software shall be capable of scaling to an estimated annual volume of 30 million claims. As the FSC’s customer base expands, the software will need to continue to scale to meet the performance requirements outlined in section 5.2. The Contractor shall also scale the corresponding support required by PWS sections 5.3.8.

Deliverables:

A. Perpetual Software Product/License (due within 30 days of contract award)

5.2 SYSTEM FEATURES AND CAPABILITIES

The FWA system will serve with the VA-FSC’s healthcare claims adjudication enterprise solution eCAMS HCE and provide real-time pre-payment fraud detection.

Where the requirements call for integration to an existing VA system, the FSC will be responsible for the execution of the interface between the vendor's COTS software and existing SOA interfaces.

5.2.1. LANDING PAGE INTERFACE

a. Provides system status messages (planned system outages and system messages)

b. Displays individual user information (username, role, user ID, user organization and last login date/time, claims in que, claims last processed)

c. Displays role-based Alert Summary Reporting (ASR) and Case Management Dashboard link

d. Displays role-based Business Intelligence Reporting link

e. Displays Claim Query, Search and Export Reporting link

f. Displays Informational Quick link (production issues, training schedule, model information guide and user manual)

g. Displays Help Desk (IT Service Desk) providing phone number and email.

5.2.2. PREDICTIVE ANALYTICS-BASED FRAUD, WASTE AND ABUSE (FWA) DETECTION

a. Provides real-time FWA detection prior to claim payment.

b. Provides post-payment reviews to look for overutilization of services or other practices that directly or indirectly result in unnecessary costs. Examples include, but are not limited to:

· Improper payment for services

· Payment for services that fail to meet professionally recognized standards/levels of care

· Excessive billed charges or selection of the wrong code(s) for services or supplies

· Billing for items or services that should not have been or were not provided based on documentation supplied

· Unit errors, duplicate charges and redundant charges

· Lack of sufficient documentation in the medical record to support the charges billed

· Experimental and investigational items billed

· Lack of medical necessity to support services or days billed Services billed are not covered per the member’s benefit plan, Medicare policies or Medicaid policies, such as National Coverage Determinations and Local Coverage Determinations

· Lack of objective clinical information in the medical record to support condition for which services are billed

· Items not separately payable or included in another charge, such as routine nursing, capital equipment charges, reusable items, etc.

These reviews also confirm that:

· The most appropriate and cost-effective services and supplies were provided.

· The records and/or documentation substantiate the setting or level of service that was provided to the patient.

c. Provides pre-built analytic models to identify and analyze improper claims.

d. At a minimum, the solution shall provide the following tools:

· Predictive Analysis

· Link Analysis

· Surveillance and Utilization Review System

e. Capable of identifying and learning from fraudulent patterns and scenarios to reduce false positives and adapt predictive algorithms against emerging schemes.

f. Allows for new models for FWA detection as industry patterns are discovered.

5.2.3. EDITS

a. Allows for customized edits

b. Able to identify duplicate provider claims

c. Able to identify procedure bundling and unbundling

d. Able to identify irregularities between coding combinations, procedure to diagnosis mismatches

e. Incorporates National Correct Coding Initiative (NCCI) data rules

f. Identifies Excluded Individuals and Entities (LEIE)

g. Identifies invalid or deactivated NPI numbers

h. Identifies charges significantly above or below geographic or national norms

5.2.4. RULES MANAGEMENT SYSTEM

a. Allows for customized payer specific reimbursement rules and policies

5.2.5. ALERT SUMMARY REPORTING AND CASE MANAGEMENT DASHBOARD

a. Consists of a user-friendly, graphical user interface screen, to manage workloads and predefined work queues.

b. Provides alert reporting for flagged claims in zone and assigns ASR ID to individual claims.

c. Provides a role-based display for total claims in zone and prioritizes claims that require assignment.

d. Provides role-based capability to assign flagged claims to individual users.

e. Displays individual user workload assignments and allows for prioritizing claims.

f. Displays claim header and line level details.

g. Provides drill down capability for individual claims on a summary screen (Assigned User, ASR ID, Provider Name, Alert Rationale, FWA Model or Edit utilized).

h. Allow the user to link together ASRs that are being worked as part of the same case.

i. Accurately communicates the action to be taken on a flagged claim, provider, or group of providers (i.e., automatic denial, delay payment, investigate).

j. Provides all of the information necessary to take action (such as background data that may be required by an investigator to review an issue).

k. Provides GUI Map Interface icon associated with the ASR detail that will graphically display the geographic relationship between the provider and the beneficiary (when executed).

l. Allows for a provider profile features which contains defined metrics and attributes about the provider’s patient population, billing activity, enrollment details, outputs, and summarized statistics.

m. Displays the description for displayed healthcare reference codes: i.e., Healthcare Common Procedure Coding System (HCPCS), Current Procedural Terminology (CPT), ICD-10, Place of Service (POS), Specialty Codes, and Restructured BETOS Classification System (RBCS)/CMS Data codes.

n. Allows form fields for users to record counts for the following:

a. Actions they have taken; and

b. Activities they have performed.

o. Provides a form for users to fill in additional information when specific rulings, actions, or activities are chosen.

p. Ensure users can access distinct recent claim numbers and claim examples to support evidence for the specific alert and applicable attribute(s) related and selected within the alert.

5.2.6. BUSINESS INTELLEGENCE REPORTING

a. Provide reporting views that are role-based to control access.

b. Display real time standard aggregate reports and display the results on the report.

c. Allow the user to designate any chosen timeframe they want to display for all reports.

d. Allow the user to drill down to the supporting evidence from the aggregate reports.

e. Permit users to create ad-hoc reports and save them as user defined group reports making them accessible to other users within their organization.

f. Provide reports to users which illustrate the different model’s performance.

g. Allow reporting capabilities that can drill down by Model or Edits, Geographic Region, Type of Service, Type of Provider, and other relevant variables defined by VA-FSC.

h. The system shall track the original source of alerts as well as the ultimate resolution of alerts and pass this information back to VA-FSC. The data collected shall provide for results reporting such as:

· False Positive rates

· Return on Investment and Cost Avoidance

· Alerts and scoring results

· Number of revocations, payment suspensions, claims denials, claims rejections or other actions.

5.2.7. QUERY, SEARCH AND EXPORT REQUIREMENTS

a. Provide the ability to query for alerts containing the chosen criteria:

· ASR ID

· Assigned User

· Provider

· Model or Edit Applied

b. Ability to search through user recorded notes and comments fields.

c. Ability to search through all fields on the screen.

d. Ability to export data from any FWA screen in the format of Excel, PDF or Word.

5.2.8 CAPACITY AND SCALABILITY

a. Capable of a capacity of 36 million claims annually. Claim volumes across lines of business may increase incrementally over the life of the contract.

b. Allows up to 5,000 active concurrent users, who may not be performing the same functions, on the software at the same time.

c. Can process up to 150,000 claims per day without performance degradation.

d. Allows response times on the user interface of no more than three seconds, regardless of the function being performed.

e. Supports adding IT infrastructure to scale up or scale out.

f. Can be configured to provide measurable throughput on end-to-end transaction processing, of less than three seconds.

g. The contractor shall complete capacity planning and review after each release.

5.2.9. SECURITY AND CONFIDENTIALITY

a. Architecture of the software provides safeguards for sensitive data within the VA Firewall; so patient and healthcare information confidentiality is maintained, and there is compliance within the regulatory environment, personally identifiable information (PII), Protected Health Information (PHI), and 38 U.S. Code §7332 Protected Data.

b. Supports Lightweight Directory Access Protocol (LDAP) integration for user access and authentication.

c. Supports single sign-on.

d. All system components shall be considered FISMA-High and shall comply with the following policies, handbooks, guidelines at the application and database levels:

VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

i. Handbook_6500_24_Feb_2021 (1).pdf

ii. VHA Directive1906 (Data Quality Requirements for Healthcare Identity Management and Master Veteran Index), April 10, 2020 1906_D_2020-04-10.pdf

iii. NIST 800-53 Version 5 (Security and Privacy Controls for Federal Information Systems and Organizations) Security and Privacy Controls for Information Systems and Organizations

iv. DISA-STIG (Defense Information Systems Agency Security Technical Implementation Guide) Security Technical Implementation Guides (STIGs) – DoD Cyber Exchange

v. OMB M-04-04 (E-Authentication Guidance for Federal Agencies) M-04-04

vi. NIST 800-63-3 (Digital Identity Guidelines) NIST Special Publication 800-63-3

vii. VA Handbook 0735-HSPD-12 (Homeland Security Presidential Directive 12 Handbook) www.va.gov/vapubs/viewPublication.asp?Pub_ID=758&FType=2

e. The Contractor shall identify the testing methods and tools used to verify compliance with the above security policies, handbooks, and guidelines.

f. The Contractor shall provide proof of compliance with all security policies, handbooks, and guidelines included in this document.

Deliverables:

A. Identification of Testing Methods and Tools used to Verify Compliance (Due within 10 days of VA request) B. Proof of Security Compliance (Due within 10 days of VA request)

5.2.10. SYSTEM INTEGRATION AND INTEROPERABILITY

a. Capable of integrating with VA-FSC eCAMS HCE system and Veteran Health Administration (VHA) medical claims databases.

b. Consists of a system architecture that is open and provides interoperability capabilities through the use of web services using Simple Object Access Protocol (SOAP) or Representational State Transfer (REST).

c. Integrates with Service Oriented Architecture (SOA) and Enterprise Service Bus (ESB) platforms.

d. Supports integration patterns approved by VA Enterprise Architecture, as well as Federal and NIST guidelines (HSPD-12 and Federal Identity, Credential, and Access Management (ICAM)).

e. Functional on all VA environments to include development, testing and production.

5.2.11. HIGH-AVAILABILITY

a. Supports a high availability configuration such as failover or clustering and eliminates single points of failure.

5.2.12. TECHNICAL REFERENCE MODEL (TRM)

a. Contractor shall ensure all software and system components delivered under this contract can be approved on the VA Technical Reference Model (TRM), whose website can be found at https:// www.va.gov/trm.

b. Contractor shall submit a list of all software and system components to the VA-TRM group no later than 30 days following date of contract award for TRM approval.

c. Contractor shall ensure all software and system components are rated FISMA-HIGH in accordance with Section 2.0 FISMA requirements, which would increase the probability of software and components being TRM approved.

d. Contractor shall ensure all software and system components will be revised in accordance with TRM requirements.

e. Contractor shall ensure all software and system components are in compliance with VA TRM requirements within six (6) months of contract award, and stay in compliance with VA TRM from that point forward, as long as the software is in use by FSC.

Deliverable:

A. List of all software and system components no later than 30 days following date of contract award.

5.2.13. TECHNOLOGY STACK

1. Shall be capable of running on the following technology stack components:

a. Intel x64 hardware, using Windows 2012 R2 Operating System or Redhat Linux 7.x on a VMware virtualization platform. A technology stack is a set of software that provides the infrastructure for a computer. The stacks differ whether installed in a client or a server.

b. Either Microsoft SQL Server 2012 R2, Microsoft SQL Server 2014 or Oracle 12c.

c. SOAP, REST, JSON, or Oracle Service-Oriented Architecture and Oracle Service Bus, which will be the foundation for shared services.

2. Shall comply with VA's Technical Reference Model (TRM). Reference: www.va.gov/TRM.

5.2.14. HISTORICAL DATA PURGING AND RE-LOADING

a. Allows users to define data retention schedules and can be programmed for automated archiving and purging data, based on age.

b. Able to perform both complete system data archival support and partial data archival support; based upon specified data criteria, such as dates.

c. Allows archival data to be restored by mid-level production support resources. Recovery tasks shall be performed without administrative rights to back-end databases and other systems.

5.2.15. SYSTEM CONFIGURATION RETENTION AND MIGRATION

a. Able to back up and restore system configuration information and criteria, separate from claim data.

b. Capable of migrating system configurations between environments

5.2.16. DATA INPUT, CLAIMS INTAKE, AND DATA ACCESSIBILITY

a. Allows claim data input from various sources including eCAMS HCE, EDI, Optical Character Recognition (OCR), and manual data entry.

b. Capable of displaying a rendered image of the claim from an electronic claim submission.

c. Can store hyperlinks to electronic documents or images in multiple ‘entities’ (such as member, claim, provider, and authorization) so this information can be viewed when clicked.

d. Can be easily navigated and cross-referenced, such that entities referenced in any object can be drilled down to a hyperlink that opens that entity without having to navigate back to the main screen.

e. Supports the following X12 5010 administrative transaction sets:

i. 837I; 837P; 837D claim files

ii. 835 payment files

iii. 277CA and 999 response files

iv. 270 eligibility inquiries

v. 278 service reviews

vi. 276 claim status inquiries

f. Allows update of the X12 and NCPDP administrative transaction sets to the next HIPAA mandated version.

5.2.17. FWA Operational and Application Support

The Contractor shall provide operational and application support for the FWA system that includes Defect Tracking and Resolution described in the following subsections.

5.2.18. Defect Tracking and Resolution

The Contractor shall implement a quality management process that supports all scheduled and unscheduled maintenance, is coordinated with the VA-FSC, and ensures the proper identification, tracking, and timely resolution of defects in the operational FWA system. Defects shall be tracked in an approved defect tracking system with shared access by both the Contractor and VA-FSC. The Contractor shall propose its defect tracking system to VA-FSC for the agency’s review and approval. The Contractor’s quality management process shall ensure the identification, mitigation, and resolution of quality risks and production-level defects as early as possible in the development and production life cycles. The Contractor shall update VA-FSC on the status of all open defects and communicate the defect rate throughout the development and production life cycles.

Deliverable:

A. Defect Tracking System (Due within 10 days of VA request)

5.2.19. End User Training

Training delivery methods may include webinars, in-person, and video teleconferencing sessions. The Contractor shall be prepared to accommodate ad hoc training delivery requests for VA-FSC-approved users and VA-FSC contractors. In-person training classes to facilitate initial user on-boarding shall take place at designated VA-FSC facilities. After receiving initial in-person training, participants may receive course updates through interactive delivery methods.

Prior to deployment of the operational FWA system, the Contractor shall:

· Develop a training plan that includes a plan for training identified trainers from each user organization.

· Develop training materials and a user guide for dissemination at all training sessions.

· Deliver demonstration and training sessions to different audiences, including VA-FSC and program integrity contractors, in both virtual and in-person environments. The Contractor’s responsibilities for demonstration and training sessions include the following:

· Any in-person sessions will be scheduled at the direction of at the VA-FSC furnished training facility.

· The Contractor shall provide handouts of the presentation to the participants at in-person sessions.

· For any virtual or in-person demonstration, the Contractor shall be prepared to walk through the FWA capabilities for participants using a real-time demonstration of system capabilities, and address user questions.

After the initial rollout of the FWA system to users, the Contractor shall offer ongoing support end-user training and self-help options as follows:

· The Contractor shall routinely create, update, and maintain technical support documentation related to incident prevention, error types, and resolution methods to assist users.

In addition to the regular training (regular training schedule is defined every month and every release) up to 10 additional ad hoc training sessions may be required.

Deliverable:

A. Training Plan (Due within 10 days of VA request) B. Training Materials (Due within 10 days of VA request) C. Training Sessions (As needed and in coordination with VA)

6.0. GENERAL REQUIREMENTS

6.1. ENTERPRISE AND IT FRAMEWORK

6.1.1. VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.1.2. FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA…