RFI PWS- PIVOT Final Draft.docx

Payment Integrity Validation and Oversight Tool (PIVOT)

VA-26-00015670

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Integrated Veterans Care

Payment Integrity Validation and Oversight Tool (PIVOT) Date: January 8th, 2026

VA-26-00015670

PWS Version Number: 3.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), within the Veterans Health Administration (VHA), Office of Integrated Veteran Care (IVC), provides high-quality, effective, and efficient Information Technology (IT) services. These services are crucial for those responsible for delivering care to Veterans at the point of care and throughout all stages of the Veterans’ health care journey, ensuring care is effective, timely and compassionate. VA depends on Information Management/Information Technology (IM/IT) systems to meet its mission goals.

VA IVC requires a Payment Integrity Validation and Oversight Tool (PIVOT) to proactively detect and prevent improper VA Community Care healthcare claims and invoice payments. These improper payments may result from inaccurate coding, billing, unauthorized services, or other non-compliance with VA or Centers for Medicare & Medicaid Services (CMS) reimbursement policies, including fraud, waste, and abuse (FWA). PIVOT will achieve this through advanced analytics, automation, and seamless integration with existing VA systems.

Currently, VA relies heavily on manual, retrospective processes to detect improper payments, which limits its ability to identify issues in a timely and comprehensive manner. These limitations hinder corrective actions, delay recoupment efforts, and reduce the overall efficiency of the program.

By automating complex compliance checks and aligning with evolving reimbursement policies, PIVOT will reduce financial waste, improve operational efficiency, and safeguard taxpayer resources. Additionally, it supports provider trust and continuity of care for Veterans by ensuring payments are accurate and timely. Without this capability, VA risks continued reliance on manual, retrospective processes that delay issue detection, hinder recoupment efforts, and increase the risk of FWA.

The VA Community Care program has experienced significant growth due to legislative expansions such as the VA Maintaining Internal Systems and Strengthening Integrated Outside Networks (MISSION) Act, the Promise to Address Comprehensive Toxics (PACT) Act, and the Veterans Comprehensive Prevention, Access to Care and Treatment (COMPACT) Act, and the Senator Elizabeth Dole 21st Century Veterans Healthcare and Benefits Improvement Act. This growth has increased the volume and complexity of healthcare claims and invoices, creating challenges in ensuring payment accuracy and compliance.

The implementation of PIVOT is a strategic initiative to modernize VA’s payment integrity capabilities. The solution will enable systematic analysis of the entire claims and invoice dataset, allowing for the early detection of improper payments and potential FWA. It will support VA staff in developing cost containment strategies, proactively identifying suspicious billing trends and patterns, executing recoupments, and improving compliance with reimbursement policies.

Key stakeholders include various Program and Payment Integrity teams within IVC, and VHA, who are responsible for identifying improper payments, coordinating corrective actions, and managing recoupment activities. PIVOT will also benefit Veterans, providers, and VA staff by improving the accuracy and timeliness of payments, reducing administrative burdens, and enhancing the quality-of-care delivery.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement (PWS), the Contractor shall comply with the following:

The Contractor shall remain current with updates to applicable federal laws, regulations, VA policies, and industry standards and documents and incorporate any changes into the system within timeframes specified by VA.

The following documents and references are applicable to the performance of this contract and shall be used to guide system design, development, integration, and compliance validation. This list is not intended to be exhaustive:

VA Policies and Guidelines:

· VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

· VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

· VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

· VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

· VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

· VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

· VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

· VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

· VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

· VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

· VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

· VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

· VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

· VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

· VA Directive 6300, “Records and Information Management,” September 21, 2018

· VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

· VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

· IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

· VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019

· VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

· Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

· VA Acquisition Regulation (VAAR) - https://www.va.gov/oal/library/vaar/

· VA Payment Policies*

· VA Clinical Determinations and Indications (CDI)

· VA Community Care Program Guidelines*

· VA Information Security and Privacy Policies

· “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

· “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

· OIT Process Asset Library (PAL), OIT Process Asset Library

· VA Technical Reference Model (TRM) -https://www.va.gov/trm/TRMHomePage.aspx

· VA Fee Schedule (VAFS)

· Dental VA Fee Schedule* (DVAFS)

Please note that the above items marked with an asterisk (*) contain proprietary information belonging to the Department of Veterans Affairs. This information is intended solely for internal VA use and may be shared with Contractors only when there is a legitimate need to know. Contractors are strictly prohibited from disclosing or distributing any content marked with an asterisk.

CMS References:

· CMS National Correct Coding Initiative (NCCI) Edits

· Medically Unlikely Edits (MUE)

· Multiple Procedure Payment Reduction (MPPR)

· CMS Prospective Payment System (PPS) Guidelines:

· Inpatient PPS (IPPS)

· Outpatient PPS (OPPS)

· Skilled Nursing Facility PPS (SNF PPS)

· Inpatient Rehabilitation Facility PPS (IRF PPS)

· End-Stage Renal Disease PPS (ESRD PPS)

· Federally Qualified Health Center PPS (FQHC PPS)

· Inpatient Psychiatric Facility PPS (IPF PPS)

· Long-Term Care Hospital PPS (LTCH PPS)

· Home Health PPS (HH PPS)

· Hospice Payment System

· Ambulatory Surgical Center (ASC) Payment System

· Critical Access Hospital (CAH) Cost-Based Pricing Model

· All-Payer State Pricing Model

· PPS-Exempt Cancer Hospitals (PCHs)

· CMS Fee Schedules and Medicare Administrative Contractor (MAC) Pricing Guidelines

· CMS Medicare Claims Processing Manual

· CMS Coverage Determinations and Local Coverage Determinations (LCDs) Industry Standards and Coding References:

· American Medical Association (AMA) Current Procedural Terminology (CPT) Coding Guidelines

· American Dental Association (ADA) CDT Coding Guidelines

· International Classification of Diseases (ICD), Procedure Coding System (PCS), Clinical Modification (CM) ICD-10-CM and ICD-10-PCS Coding Guidelines

· Healthcare Common Procedure Coding System (HCPCS)

· X12 Electronic Data Interchange (EDI) Standards

· CHAMPUS Maximum Allowable Charge (CMAC) Guidelines Data Sources and Registries:

· CMS Physician Specialty Code Set

· National Plan and Provider Enumeration System (NPPES)

· Provider Enrollment, Chain, and Ownership System (PECOS)

· Office of Inspector General (OIG) List of Excluded Individuals/Entities (LEIE)

· TRICARE

· CMS Frequency/Utilization Reports Interoperability and Integration Standards:

· Health Level Seven (HL7)

· Fast Healthcare Interoperability Resources (FHIR) Federal Laws and Regulations:

· Federal Information Security Modernization Act of 2014 (FISMA 2014)

· FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

· FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

· FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

· Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

· Health Insurance Portability and Accountability Act (HIPAA)- Public Law 104-191

· 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

· Privacy Act of 1974, as amended, 5 U.S.C § 552a

· Federal Acquisition Regulation (FAR), as applicable; https://www.acquisition.gov/far

· OMB Circular A-130 – Managing Information as a Strategic Resource and OMB Circular A-11 – Preparation, Submission, and Execution of the Budget; https://www.whitehouse.gov/omb/information-regulatory-affairs/circulars/

· Payment Integrity Information Act of 2019

· False Claims Act (31 USC 3729-3733)

· Social Security Act (Act) - Exclusion Authorities

· Social Security Number (SSN) Fraud Prevention Act of 2017

· Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

· Anti-Kickback Statute [(42 USCC 1320a-7b(b)]

· Physician Self-Referral Law (Stark Law) [42 USC 1395nn]

· Section 508 of the Rehabilitation Act - https://www.section508.gov/

· Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

· Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

· CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

· CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

· CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA National Institute of Standards and Technology (NIST) Special Publications:

· NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

· NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

· NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

· NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

· NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, "Digital Identity Guidelines," updated March 02, 2020

· NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024 NIST SP 800-88 Revision 1 "Guidelines for Media Sanitization," December 2014 Office of Management and Budget (OMB) Memorandums:

· OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

· OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

· OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

· OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

· OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

· OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

· OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles,” January 26, 2022, https://www.whitehouse.gov/wpcontent/uploads/2022/01/M-22-09.pdf

· OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

· OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

SCOPE OF WORK

The Contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and services necessary to provide, implement, and support a scalable and efficient PIVOT for VA. The system shall enhance VA’s ability to detect improper healthcare, pharmacy, and dental payments and ensure compliance with established reimbursement policies and guidelines.

The Contractor shall provide a PIVOT solution capable of supporting a minimum of 100 concurrent users that integrate with existing VA systems, ingests a wide variety of claims and invoices, healthcare data, and leverages advanced analytics and machine learning to identify improper payments, including FWA. The Contractor shall also provide ongoing support, project management, testing, training, customer service, business continuity and disaster recovery, and system enhancements to ensure the success of the PIVOT during the period of performance.

The PIVOT solution shall be implemented as a Software as a Service (SaaS). The Contractor shall deliver PIVOT as a complete, turnkey service. The Contractor shall be responsible for all aspects of the solution, including provisioning, configuration, maintenance, patching, monitoring, and support of the software and platform components. The solution shall comply with the Federal Risk and Authorization Management Program (FedRAMP) High baseline, VA Handbook 6500, VA Handbook 6517, and VA Directive 6513. The Contractor shall provide documentation demonstrating compliance with FedRAMP High and VA-specific security directives, at the time of proposal. It shall support secure, scalable, and elastic deployment models, and integrate with VA’s identity and access management infrastructure, including Personal Identity Verification (PIV) authentication and role-based access controls. The system shall be accessible via VA-approved remote access methods (e.g., Azure Virtual Desktop, Citrix Access Gateway), and shall support high availability, disaster recovery, and secure multi-tenancy. All data storage, processing, and transmission shall occur within the United States and comply with VA data residency and security requirements.

Objectives The Contractor shall ensure that PIVOT meets the following objectives:

· Integrate Seamlessly with VA Systems:

The system shall integrate with existing VA systems, and other Federal systems as directed by VA, using secure Application Programming Interfaces (APIs) or other approved methods. It shall support real-time data exchange and interoperability with VA’s financial, eligibility, referral, and provider systems, as well as external data sources, using standards such as HL7 and FHIR.

· Ensure Claims and Invoice Compliance:

PIVOT shall validate post-adjudicated claims against applicable CMS and VA reimbursement policies, including pricing, coding, billing, coverage, and business rules. This includes the integration of CMS edits, VA-specific rules, and industry-standard compliance frameworks to ensure accurate and compliant claims and invoice processing. The system shall support a scalable and configurable rules engine capable of accommodating a comprehensive and evolving set of reimbursement policies and compliance checks.

· Automate and Enhance Audit Efficiency:

PIVOT shall automate post-payment review and validation to replace manual, retrospective methods with proactive, scalable, and efficient processes. The system shall support real-time rule execution and automated flagging of improper payments to reduce administrative burden and improve audit throughput.

· Detect Improper Payments and FWA:

PIVOT shall leverage advanced analytics and artificial intelligence (AI), including machine learning (ML), to detect improper payments, including potential FWA. Detection shall occur at multiple levels, including individual claims and invoices, providers, patients, and services, using both rules-based and pattern recognition models.

· Aggregate and Normalize Data for Analysis:

PIVOT shall ingest and normalize data from diverse sources, including claims and invoices, eligibility, referral/authorization, provider files, and external healthcare datasets. The system shall ensure data consistency and integrity to support comprehensive and accurate analysis.

· Deliver Actionable Insights and Reporting:

The system shall provide dashboards, reports, and visualization tools that enable VA staff to monitor flagged issues, track potential cost savings, and support decision-making. These tools shall be customizable by user role and support export and integration with other VA systems.

· Support Continuous Improvement through Feedback Loops:

The system shall incorporate Human-in-the-Loop (HITL) learning and feedback mechanisms that allow VA users to confirm or dismiss system-generated flags. These outcomes shall be used to retrain AI/ML models and refine business rules, improving detection accuracy over time.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods. The overall PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is equal to or greater than 2 trips per calendar year. Anticipated locations include the following, estimated at 2 or more days in duration:

· Washington, D.C.

· Denver, CO

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

KICKOFF MEETING

The Contractor shall conduct a project kickoff meeting within 10 business days following award to introduce key stakeholders, define roles and responsibilities, and review project objectives and deliverables. During this phase, the Contractor shall collaborate with VA stakeholders to gather and clarify all requirements, ensuring alignment with VA needs and expectations.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a comprehensive Contractor Project Management Plan (CPMP) that outlines the approach, timeline, tools, and methodology for the execution of PIVOT implementation. The CPMP shall present both narrative and graphic formats to display the schedule, milestones, risks, and resource allocation. The CPMP shall also detail how the Contractor will coordinate and execute planned, routine, and ad hoc data collection, as well as reporting requests as identified within the PWS. The Contractor shall provide comprehensive documentation for all project phases and deliverables, ensuring clarity and consistency. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA-approved CPMP throughout the PoP.

The CPMP shall include the following components:

Comprehensive Project Plan The Contractor shall develop a detailed project plan that includes:

· Project charters, plans, and schedules

· Requirements documentation

· Technical specifications and design documents

· User manuals and training materials This plan shall outline the overall timeline, key milestones, resource allocation, and risk management strategies. A high-level implementation roadmap, including proposed phases, Minimum Viable Product (MVP) scope, and release cadence, shall also be part of the project plan. This roadmap shall be refined in collaboration with VA stakeholders and updated regularly throughout the project lifecycle.

Agile Delivery Framework Schedule The Contractor shall adopt an agile delivery framework to guide the development, implementation, and enhancement of the PIVOT. A multi-tiered release process, subject to VA review and approval, will enable incremental delivery of functionality over time. Each release shall be aligned to, at minimum, a monthly cadence, with clearly defined deliverables, acceptance criteria, and stakeholder review checkpoints. The Contractor shall ensure release artifacts (e.g., backlog, user stories, burn-down charts) are consistent, maintained and accessible to VA.

Stakeholder Engagement Plan To maintain regular communication and updates throughout the project lifecycle, the CPMP shall include a stakeholder engagement plan. The Contractor shall define and implement a stakeholder engagement plan to maintain regular communication and updates throughout the project lifecycle.

Project Design The Contractor shall develop detailed system design documentation, including system architecture, integration points, and user interface design. The Contractor shall present the system design to VA stakeholders for review and obtain necessary approvals prior to development, and shall work with VA during implementation and deployment.

Deployment Plan The Contractor shall develop a comprehensive deployment plan that outlines the steps, timeline, and contingency measures for system go-live. The contractor shall execute the deployment plan to launch the PIVOT into the production environment and provide immediate post-deployment support to address any issues encountered during the initial usage phase.

Deliverable:

Contractor Project Management Plan.

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer Representative (COR) with monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose, and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

· Monthly Progress Report.

PIVOT Core Functional Requirements The Contractor shall ensure that a minimum of 100 licenses are available for use by VA. VA users include auditors, analysts, and administrative personnel. The Contractor shall ensure that PIVOT has the capability for all licenses available for use by VA, including those added through the exercise of optional tasks, to be used concurrently. Additionally, the Contractor shall ensure that the system supports scalability to accommodate future growth.

The Contractor shall ensure that the PIVOT solution is capable of supporting the full scope of VA’s enterprise claims and invoice processing workload. The system shall be designed to ingest, process, and analyze an estimated 82 million healthcare claims and invoices annually, inclusive of all associated data elements (e.g., claim and invoice headers, line items, remittances, and metadata). The system shall also be scalable to accommodate potential increases in claims and invoice volume resulting from growth in VA Community Care utilization and expansion of the eligible Veteran and Beneficiary population over the period of performance.

The system shall maintain performance, availability, and data integrity standards under this volume and be scalable to accommodate future increases in transaction volume without degradation in system responsiveness or adjudication accuracy. It is acceptable that the Contractor meets requirements through configuration of existing platform capabilities rather than custom software development, wherever feasible.

PIVOT shall provide the following core functional requirements:

Data Ingest and Management

The Contractor shall provide a system that can receive and parse historical and new 837P, 837I, 837D, and National Council for Prescription Drug Program (NCPDP), test claim tracer files, and gather and integrate data from various sources such as CMS Physician Specialty Code Set, National Plan and Provider Enumeration System (NPPES)/Provider Enrollment, Chain, and Ownership Program (PECOS) specialty files, Office of the Inspector General (OIG) List of Excluded Individuals/Entities (LEIE), CMS frequency/utilization reports, Prospective Payment Systems (PPS), CMS/VA Fee schedules, National Drug Codes (NDC), Federal Drug Administration (FDA) Approved Drugs, VA eligibility systems, VA Referral/Authorization systems, Provider file information, and other relevant healthcare databases. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable. The system shall store point-in-time data for designated sources as specified by VA, ensure such data is retrievable upon request within 24 hours, and retain it in accordance with defined retention schedules and regulatory requirements.

The Contractor shall ensure the system aggregates, parses, and normalizes this data to ensure consistency and facilitate comprehensive analysis. The Contractor shall normalize data from multiple adjudication systems and Electronic Data Interchange (EDI) transaction types, including 837P, 837I, 837D, NCPDP, and 835s. The normalization process shall standardize data structures, code sets, and field formats across all sources. The Contractor shall ensure accurate mapping of claims and invoices, and remittance data into a unified schema. Claims and invoices, and payments must be linked using control numbers and other identifiers to maintain traceability. The system shall resolve duplicate or inconsistent records and preserve referential integrity across all integrated systems and flag any unauthorized data duplication.. All normalized data shall include metadata identifying the source, transformation logic, and processing timestamps.

The Contractor shall ensure system functions as a pass-through for incoming claims and invoices such that all received 837P, 837I, 837D, 835, and NCPDP transactions are transmitted to designated downstream VA systems after undergoing compliance checks through PIVOT. Following PIVOT processing, the system shall transmit the original claim or invoice—along with any appended metadata or flags—via standard EDI formats to designated VA systems for further adjudication, payment or reimbursement, or archival. The transmission shall utilize standard EDI formats as approved by VA, ensuring compatibility with VA’s designated systems and workflows. The system shall maintain a complete audit trail for each claim and invoice, capturing timestamps, processing steps, applied rules, generated flags, and transmission status to downstream systems.

The Contractor shall ensure that the system is designed and configured for high throughput performance, capable of processing all incoming claims and invoices at, or near real time without introducing delays that impact downstream payment workflows. The system shall be capable of handling peak volumes efficiently to avoid any backlog, ensuring that claims and invoices are processed and forwarded to designated downstream VA systems promptly. The system shall be capable of processing up to 8 claims or invoices per second during peak usage periods. This capability shall be sustained without degradation in data integrity, audit logging, or downstream system performance. The Contractor shall include robust monitoring and alert mechanisms to immediately identify and mitigate any issue that might impede timely claim and invoice processing. The Contractor shall ensure the system performs data validation and integrity checks to ensure the accuracy and completeness of the ingested data. The system shall be able to handle updates to data sources and ensure that changes are accurately reflected in analyses and reports. The system shall provide mechanisms for revalidation of data when source updates occur.

The Contractor shall provide a monthly data quality assessment report which shall include archived and backed-up data repositories and audit logs for all claims and invoices processed.

Performance Metric:

· Data quality resolution rate: ≥ 98% of VA-reported data errors resolved within 3 business days of notification from VA.

· Data updates: 100% of source data updates reflected in system outputs within 5 business days of receipt from VA.

· Revalidation logs: 100% of revalidation events logged and traceable to source change events.

· Data issues: ≤ 1% recurring data integrity issues across reporting periods.

· System uptime for ingest module: ≥ 99.9%

· Audit trail completeness: 100% of claims and invoices processed must have full traceability

Deliverable:

Data Quality Assessment Report

The Contractor shall ensure that the system includes a comprehensive and easily navigable Data Dictionary that is accessible within the system’s graphical user interface (GUI) for authorized VA users. The Data Dictionary shall:

· Provide a complete catalog of all data elements with clear definitions.

· Include all metadata, for example:

· Data type

· Source system

· EDI loop and segment (if applicable)

· Primary and foreign key relationships

· Include a database schema diagram that visually represents the structure and relationships of the data.

· Support filtering, searching, and exporting within the GUI.

· Be continuously updated to reflect any changes to the system’s data structure or logic.

· Be accessible only to authorized VA personnel, with appropriate role-based access controls.

In addition to the GUI-accessible Data Dictionary, the Contractor shall provide the following as a quarterly deliverable to VA, or upon any system change that affects the data structure:

· Changelog

· A documented log of all updates, additions, or removals to the Data Dictionary, including the rationale for each modification.

· Access Control List (ACL)

· A current list of authorized VA users with defined access permissions to the Data Dictionary and associated metadata.

· Data Dictionary Crosswalk/Matrix

· A mapping matrix that aligns data elements across systems, formats, or standards showing equivalencies, transformations, and relationships.

These deliverables shall be provided in an exportable format (e.g., Excel, PDF, or web-based UI) and submitted to VA-designated personnel as part of the system’s ongoing documentation and transparency requirements.

Performance Metric:

· Update frequency: 100% of system changes reflected in the data dictionary within 5 business days

· Accessibility: 100% availability to authorized VA users

· Documentation completeness: 100% of data elements documented with required metadata

· Changelog accuracy: 100% of updates include rationale and effective date

The Contractor shall archive data that is no longer actively used but must be retained for regulatory, legal, or historical purposes. Archived data shall be indexed and searchable to support retrieval and reference.

Archived data shall be:

· Indexed and searchable to support timely retrieval and reference.

· Indexed at three key points: (1) Ingestion into the system, (2) After system decision, and (3) Upon response and ingestion from bidirectional feed.

Archived data shall be classified in accordance with:

· The Principle of Provenance: Data must be categorized based on its source.

· The Principle of Order: Data must retain its original structure and classification hierarchy.

The Contractor shall maintain a backup solution for current and active data to support operational recovery in the event of data loss or corruption. The Contractor shall ensure that data archiving and data backup are treated as distinct functions with separate storage, processes, and objectives. The Contractor shall comply with all applicable federal, VA, and industry data retention and privacy regulations.

The Contractor shall routinely update the system to incorporate the latest CMS and VA updates, technological advancements, security enhancements, and compliance with regulatory changes. This includes both scheduled updates and urgent patches. The contractor shall incorporate feedback from VA users to continuously improve the system’s functionality, usability, and performance.

The Contractor shall deliver computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out, or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor shall indemnify the Government for all damages suffered as a result of a disabling caused by such code, and remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

Rules Engine

The Contractor shall design, implement, and maintain a comprehensive Rules Engine that serves as the core compliance validation component of the PIVOT solution. The Rules Engine shall ensure that all ingested claims and invoices are evaluated against VA and CMS reimbursement policies, pricing logic, and industry-standard compliance frameworks at or near real time. The Rules Engine shall be configurable, transparent, and capable of adapting to evolving regulations and business requirements without requiring custom code changes.

The Rules Engine shall provide the following foundational capabilities:

· Configurable Logic Execution: Including support for CMS edits, VA-specific business rules, Prospective Payment System (PPS) logic, and fee schedule validations.

· Prioritization and Sequencing: Ability to apply critical rules first, followed by secondary checks, based on VA-defined hierarchies. (e.g., VA > CMS > industry standard)

· Conflict Detection and Resolution: Mechanisms to identify, flag, and manage contradictions or conflicts between overlapping rules, reimbursement policies, coding guidelines, or regulation/statutes rules. Applying resolution logic and/or recommended resolution paths according to VA-approved priorities.

· Version Control, Metadata, and Audit Trails for all rules and historical rules. This includes:

· A complete audit trail of all rule changes, including timestamps, user identity, change rationale, and version history.

· The ability to view and compare historical versions of a rule

· The ability to revert to a previous version/rule if needed

· Integration of versioning metadata into the Rules Library for transparency and traceability.

Rules Library and Transparency The Contractor shall deliver a comprehensive Rules Library that catalogs all active, inactive, VA disapproved, and under-review rules. Each rule entry shall include its description, source authority (e.g., CMS, VA policy, statute), effective dates, and version history. The library shall provide full transparency into rule logic, pricing formulas, and calculation steps, ensuring that no component operates as a “black box,” Where you only see the result without knowing how it was derived. The library shall allow filtering, searching, and reporting capabilities to enable VA personnel to easily find and reference specific rules. Additionally, the Contractor shall ensure the Rules Library is continuously updated and accessible to authorized VA personnel, ensuring transparency and ease of reference for users. Regular updates to the Rules Library shall be communicated to VA-designated personnel, including changelogs and the rationale for any modifications. All logic shall be exportable in VA-approved formats such as Excel, PDF, or JSON.

Governance and Change Management The Contractor shall implement a structured governance process for rule creation, modification, and retirement. No rule may be added, changed, or removed without prior VA approval. The governance process shall include:

· A multi-tier agile release workflow: Development → Test → Pre-Production → Production. Rules may progress sequentially or revert to a prior tier at any stage for additional development, correction, or validation. The Contractor shall implement a structured change process that allows tested rules to be reviewed, approved, and migrated through the following environments:

· The development environment shall function as a sandbox (for rule simulation, testing, conflict identification and resolution, and impact assessment) which enables authorized VA users and contract developers the ability to develop and create new or modified rules without impacting live operations or data.

· The test environment shall function as a testing environment when approved rules created in the sandbox are approved by VA and promoted for additional tests including regression testing, functional testing, and user validation.

· The pre-production environment shall function as a mirror of the production environment where VA users can complete User Acceptance Testing (UAT) of new rules against relevant claims and invoices.

· The production environment shall function at or near real-time to implement the rules engine and score claims and invoices.

· Auditable records of all rule proposals, approvals, and implementation status. The system shall allow authorized VA users to promote or demote rules between environments without compromising version integrity or audit trail requirements.

· This flexibility shall maintain compliance with all security, approval, and traceability requirements.

The Contractor shall deliver all proposed new rules, modifications, or removals to VA in a standardized format for review and approval prior to inclusion in the Rules Engine. Each submission shall include at minimum:

· Rule logic and description

· Applicable claim and invoice types and conditions

· Source authority (e.g., CMS, VA policy, statute)

· Effective date and version history

· Impact analysis (e.g., estimated number of claims and invoices affected, financial exposure)

The Contractor will coordinate with the VA on additional criteria that may be necessary to fully evaluate the new, modified, or removed rule. The Contractor shall provide these submissions through a VA-approved channel and maintain an auditable record of all rule proposals, approvals, and implementation status.

Rule Simulation, Impact Assessment, and Overpayment/Recoupment Tracking The Contractor shall ensure the system includes functionality to simulate and assess the impact of new, modified, or identified rules on historical claims and invoice data and to track overpayments/underpayments and associated recoupments. This capability shall:

· Allow VA users to test rule logic against a defined dataset without affecting production claims and invoices.

· Provide impact metrics, including:

· Number and types of flags generated.

· Estimated financial impact and potential recoupment amounts.

· Support side-by-side comparisons of rule versions or logic changes.

· Be accessible within the pre-production environment and integrated into the rule change governance process.

· Enable testing of rules to:

· Validate rule logic and alignment with VA requirements.

· Report historical impact metrics, including affected claims and invoices, and associated dollar amounts.

· Track potential and actual recoupments for rules under review or approved rules.

The Contractor shall ensure the system ingests, integrates, and tracks recoupment data tied to improper payments, maintains detailed records for traceability and reconciliation, and complies with VA data security protocols. The system shall support accurate detection and validation of overpayments/underpayments, provide audit trails, and enable collaboration with VA and other agencies to address improper or duplicative payments. These capabilities shall ensure accountability, regulatory compliance, and the availability of historical data for audits and reviews.

Rule Performance Monitoring The Contractor shall ensure the system includes tools to monitor and evaluate the effectiveness of individual rules and rule sets. This includes:

· Tracking the frequency of rule execution and the volume of claims and invoices impacted

· Measuring false positive and false negative rates for each rule

· Calculating the financial impact of each rule (e.g., cost avoidance, recoupments)

· Providing dashboards and reports that summarize rule performance over time

· Enabling VA personnel to use these insights to refine or retire underperforming rules The Contractor shall develop and maintain a process to generate a standardized test claim tracer file for ingestion in a claims and invoice adjudication test environment. This file shall contain all necessary data elements required to simulate real-world claims and invoices, and shall be formatted in accordance with X12 EDI Standards and VA specifications.

· The Contractor shall generate this file no more than 4 times per year, based on VA’s test claim tracer schedule.

· The file shall include up to 3,000 test claims and invoices, as provided or specified by VA.

· The Contractor shall ensure that the file:

· Includes all required metadata, identifiers, and claim-level details necessary to process the test claims as if they were production claims and invoices in a claims and invoice adjudication test environment.

· Contains only de-identified or synthetic data that excludes all real patient information. All personally identifiable information (PII) and protected health information (PHI) shall be removed or replaced with non-attributable, fictitious values in accordance with applicable VA data masking, de-identification, and privacy compliance standards (e.g., NIST SP 800-122, HIPAA Privacy Rule).

· The Contractor shall deliver the finalized file to the designated VA system no later than thirty (30) calendar days after receiving the quarterly test claim tracer request from VA.

The Contractor shall ingest the resulting adjudicated test invoices into a test environment to validate the claims and invoice adjudication test environment results.

Pricing and Compliance Rules The Rules Engine shall incorporate built-in modules for key prospective payment systems (PPS), including but not limited to:

· IPPS,

· OPPS,

· Acute Inpatient PPS,

· Federal Qualified Health Center PPS,

· Home Health PPS, Skilled Nursing Facility PPS,

· Inpatient Rehabilitation Facility PPS,

·…