36C10B26Q0210.docx

Revenue Operations Workflow, Payer Compliance and Technical Process Optimization

VA-26-00042471

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

Sources Sought Notice Sources Sought Notice See Attached

Sources Sought Notice

Request for Information Revenue Operations Workflow, Payer Compliance and Technical Consulting

VA-26-00042471

1. Introduction

This Request for Information (RFI) is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

The North American Industry Classification System (NAICS) for this requirement is 541512 with a size standard of $34 million.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

There is a page limitation for this RFI of 15 pages. The Government will not review any other information or attachments included, that are in excess of the 15-page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. Generic capability statements will not be accepted or reviewed. Your response must address capabilities specific to the services required in the attached PWS and must include the following:

a. Interested Vendors shall at a minimum, provide the following information in the initial paragraph of the submission:

Name of Company Address Point of Contact Phone Number Fax Number Email address Company Business Size and Status

For VOSB and SDVOSBs, proof of SBA certification. SDVOSB/VOSB vendors that have not been certified by SBA should not respond to this notice.

NAICS code(s) Socioeconomic data Unique Entity Identifier (UEI) Number Existing Contractual Vehicles (GWAC, FSS, or MAC)

b. Provide a summary of your ability to meet the requirements contained within the draft PWS for the following areas:

a. Provide a summary of your technical capability to meet PWS paragraphs 5.2- Revenue Operations Workflow Functionality and Cloud Computing, 5.3- Claims Scoring, Reporting, and Payment Efficacy, and 5.4- Managerial and Technical Support. Your response shall include all software tools that will be leveraged in order to fulfill the PWS requirements.

b. If you were to submit a proposal, would your company be the sole provider of the complete scope of services, or is your company planning to provide any of the services sought in partnership with other entities? If it will be in partnership with another entity (or entities), identify the scope of services that will be provided by subcontractors or partners, the names of anticipated partners and the percentage(s) of the service(s) that will be provided by each of the subcontractor(s) or partner(s).Provide an overview of your company including primary services that you provide, size of the company, year established etc.

c. Describe your relevant experience in providing a similar scope of services to Government agencies or commercial organizations of similar scope, size and complexity to the VA. Include the agency name, project type, scope, length, and contract number (if applicable). Your response shall address the following areas:

(1) Describe any past or present cloud migration and implementation activities your company has managed or supported across a business enterprise. Please explain in detail the services provided in a cloud-based environment to include sustainment services for a customer base similar in size to Revenue Operations and its seven CPACs.

(2) Please explain your experience executing revenue centric workflow management services. Workflow that generates items that are both automated and set for manual review and subsequently distributed to staff throughout a large enterprise.

(3) Please provide your past or present approach to providing robotic process automation services that support automation assistance to approved work processes that reduced manual staff intervention to increase business process efficiencies.

(4) Please provide your past or present experience in providing claims scoring, reporting and payment efficacy for a large healthcare entity.

(5) Provide your experience with building, updating and maintaining compliant modeling of insurance carrier agreements comparing actual reimbursement to expected payments while quantifying payment variances based on reimbursement methodology.

(6) Please provide your approach to past or present enterprise-wide operational process and staffing improvement support for a large organization in support of tactical and strategic goals/metrics.

(7) Provide your companies experience supporting a national level program in the following:

1. Developing, optimizing, maintaining and assisting in the delivery of operational training and policy development, refinement.

2. Electronic HealthCare Record Management (EHRM) industry best practice requirements development, implementation and “go live” readiness.

3. Change management support on large scale initiatives and operational activities.

4. HIPAA / X12, NCPDP EDI subject matter expertise in a Healthcare Revenue cycle environment.

5. The development of executive level operations reports and business case products on both a regular and as needed (ad hoc) basis. These briefings often require a comparison of private sector Revenue Operations’ best practices, business standards or metrics. These executive level documents and briefings may be extended to VA under-secretary, Legislative and Office of the Inspector General (IG) personnel.

d. For SDVOSB/VOSB vendors: Your company’s intent and ability to meet the set aside requirement in accordance with VAAR 852.219-73 (JAN 2023) (DEVIATION) VA Notice of Total Set-Aside For Certified SDVOSBs and 13 CFR §125.6, which states the contractor will not pay more than 50% of the amount paid by the government to the prime for contract performance to firms that are not certified SDVOSBs listed in the SBA certification database (excluding direct costs to the extent they are not the principal purpose of the acquisition and the SDVOSB/VOSB does not provide the service, such as airline travel, cloud computing services, or mass media purchases). When a contract includes both services and supplies, the 50 percent limitation shall apply only to the service portion of the contract.

Your response shall include information as to available personnel and financial resources; full names of proposed team members and the PWS requirements planned to be subcontracted to them, which must include the prime planned percentage or the names of the potential team members that may be used to fulfill the set aside requirement.

e. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES ______ NO (if No, answer question f)

If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost effective effort.

Request for Information Revenue Operations Workflow, Payer Compliance and Technical Consulting

VA-26-00042471

Responses are due no later than 10:00am EST on February 27, 2026 via email to Gary Throckmorton, Contract Specialist at Gary.Throckmorton@va.gov and Christopher Minetti, Contracting Officer at Christopher.Minetti@va.gov. Please note “RFI - Revenue Operations Workflow, Payer Compliance and Technical Consulting” in the subject line of your response. Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.

Page 1 of

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Finance – Revenue Operations

Revenue Operations Workflow, Payer Compliance and Technical Process Optimization

Date: February 20, 2026

VA-26-00042471

PWS Version: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), is one of the world’s largest health care delivery organizations. The Revenue Operations (RO) team is seeking ongoing healthcare revenue industry modeled best practice management consulting services and healthcare revenue operations business information technology tools to sustain, transform and continuously improve revenue cycle activities within the Office of Finance (OF). Revenue Operations (RO) and the seven (7) regionally aligned Consolidated Patient Account Centers (CPACs) support a vast healthcare enterprise in the service of our Nation’s Veterans. The goal of RO is to support the field in the management of the revenue cycle. As part of that effort, RO provides a variety of program services including the following: payer relations, metric-based quality / policy operational analyses, rate development, eBusiness EDI solutions and best practice modeling with a focus on process standardization to enhance revenues.

The Consolidated Patient Account Center (CPAC) uses standardized methods, tools, and processes to improve efficiency, effectiveness, and accountability in revenue operations. CPAC’s state-of-the-art business processes ensure that VA collects revenue from private health insurance carriers for nonservice-connected care provided to insured Veterans. These funds go back to the VA Medical Centers (VAMCs) to provide health care services to our Veterans. There are seven regional CPACs located around the country that provide revenue cycle management to all the Veterans Integrated Service Network (VISNs) and their associated VAMCs. CPACs perform back-end revenue cycle processes while the VAMCs maintain ownership of key Veteran-facing revenue functions.

Transformation from the VA current state legacy system to the Oracle Health Electronic Health Record (OH EHRM) and its related health and revenue information technology tools is a critical endeavor for Revenue Operations. The RO team requires support to maintain and improve its best practice private sector revenue cycle performance while it transforms, as necessary, to the Oracle Health revenue technology tools. During preparation, deployment and stabilization of OH EHRM, RO seeks to continue its utilization of healthcare revenue business best practices and healthcare revenue business tools which provide work drivers to track and prioritize key revenue cycle activities, provide improved revenue collection services that focus on integral cash generation, improved payer management, standardization of processes, training and development of staff, along with extensive use of metrics and analytics to measure and validate performance.

These efforts are in response to Public Law 110-387, Section 406, which requires Revenue Operations and the CPACs to carry out the following functions: (1) Reengineer and integrate all business processes of the revenue cycle of the Department; (2) Standardize and coordinate all activities of the Department related to the revenue cycle for all health care services furnished to Veterans for nonservice-connected medical conditions; (3) Apply commercial industry standards for measures of access, timeliness, and performance metrics with respect to revenue enhancement of the Department; and (4) Apply other requirements with respect to such revenue cycle improvement as the Secretary may specify. In meeting these goals, VA VHA strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The VA OIT Health Finance Product Line (FPL) supports Revenue Operations. FPL strives to consolidate, integrate, and streamline the delivery of its products to improve Veterans’ access to care by reducing redundancies and increasing efficiencies. To this end, FPL has established Sub-Product Lines with product teams that are focused on specific strategic themes and requirements of the consolidation effort and require support to develop, test, deploy, and operate useful and usable products and solutions employing a Development, Security, and Operations (DevSecOps) methodology and Essential Scaled Agile Framework (SAFe) practices and any other VA-approved practices in the future. Scaled Agile Framework best practices are to be followed including the support of Program Increment (PI) Planning sessions. All development is expected to be completed using Agile practices including user stories and Agile ceremonies. This also includes regular scrum meetings with the developers including the VA OIT Product Manager (PM) and appointed PMO staff.

Product teams work with one another to ensure continuous delivery and continuous improvement resulting in business value. The requirements identified in this Performance Work Statement (PWS) are intended to provide development, testing, deployment, security and operations support for legacy, current, and future FPL Revenue Operations products in a DevSecOps lifecycle. FPL complies with the Federal Government Cloud SMART initiative. VA anticipates and understands the need for the Contractor to do some development in the Contractor IT environments; however, all shippable products must be staged in a VA-approved environment. Contract teammates support the above Agile / DevSecOps process in conjunction with the Revenue Operations Program team. This team manages the Robotic Process Automation Work Group (RPAWG), a key element of the Revenue Operations leadership teams governance process.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. VHA Finance Program and Sub-Product Lines Overview (Attachment A)

2. VHA Finance DevSecOps Application List (Attachment B)

3. VHA Finance Sample Product Backlogs (Attachment C)

4. DSO Product Line Management Playbook, May 2021 (Attachment D)

5. “Federal Information Security Modernization Act of 2014”

6. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

7. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

8. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

9. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

10. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

11. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

12. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

13. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

14. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

15. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

16. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

17. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

18. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

19. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

20. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

21. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

22. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

23. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

24. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

25. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

26. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

28. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

29. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

30. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

31. OIT Process Asset Library (PAL), OIT Process Asset Library.

32. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

33. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

34. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

35. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

36. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

37. VA Directive 6300, “Records and Information Management,” September 21, 2018

38. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

39. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

40. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

41. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

42. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

43. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

44. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

45. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

46. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

47. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

48. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

49. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

50. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

53. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

54. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

55. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

60. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

62. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

63. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

65. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

66. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

67. Social Security Number (SSN) Fraud Prevention Act of 2017

68. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

69. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

70. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

71. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

72. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

73. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

74. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

75. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

76. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

77. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

78. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

79. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

80. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

81. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

SCOPE OF WORK

The Contractor shall provide Revenue Operations with the required support in three critical areas:

· Revenue Operations Workflow Functionality

· Claims scoring, reporting and payment efficacy

· Managerial and Technical Process Optimization

The Contractor shall provide a shippable product, operations support, and security compliance for the Revenue Operations Sub-Product Line under the FPL. A shippable product is defined as one that has been deployed to a production-like environment, validated through testing, monitored for resiliency, and determined to be operable and accepted by customers. A product is completed when fully released into production and accepted by the business. This support includes all design, development, testing, integration, and architecture (with concurrence from enterprise and product line architecture), refactoring as needed, and all ongoing planned and unplanned operations and maintenance support to include predictive, preventative, corrective, and evolutionary maintenance through a cycle of Continuous Integration. The Contractor shall utilize DevSecOps principles and SAFe practices in partnership with VA. The Contractor shall provide cross-functional, Agile teams of varying size to build and maintain a platform with capabilities to streamline systems, improve scalability, increase availability and reliability of services, and more accurately measure investments in terms of business value while enabling more efficient delivery. The Agile team(s) shall work to strengthen the FPL by meeting and continuing to exceed Product Line Management maturity guidelines and DevSecOps and SAFe methodologies. These guidelines are evolving and subject to change as maturity develops within VA.

The Contractor shall adhere to VA and Office of Information Technology (OIT) policies and procedures to include, the Product Line Management Playbook, the Veteran-Focused Integration Process (VIP) Guide or VA-approved Release Management Process and adopt modern practices to continuously improve VA experiences through a combination of people, processes, and technology.

The Contractor shall provide the commercial components of the VA’s automated payer compliance and workflow management tools. This includes the provision of licensure for both tools. Additionally, the Contractor shall maintain their applications on VA servers to include installation on new servers, migration between old and new servers and coordinating data traffic to new servers, as necessary. The Contractor shall work with appropriate OIT groups such as VA App and Database teams as they provide new server virtual machines with Windows and Structured Query Language (SQL).

The Contractor shall also provide continued development/configuration, healthcare insurance modeling, and maintenance/sustainment in support of the revenue operations information technology business tools.

The Contractor shall also provide support services inclusive of revenue cycle management consulting services in support of Revenue Operations business operations and practices.

The Contractor shall provide necessary development, delivery and maintaining of training where applicable for associated builds in alignment with RO business practices and associated information technology.

PERFORMANCE DETAILS

1.1 PERFORMANCE PERIOD

The PoP shall be one 12-month base period plus four 12-month option periods and five optional tasks.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

1.2 PLACE OF PERFORMANCE

Efforts under this TO shall be primarily performed off-site at Contractor facilities. Work may be performed at remote locations only with prior concurrence from the Contracting Officer’s Representative (COR).

1.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated annual number of trips in support of the program related meetings for this effort is 10 (10 trips in each of the base and four option periods). Anticipated, typical locations include the following, estimated at three (3) – four (4) days in duration:

Location

Smyrna, TN

Madison, WI

Orlando, FL

Lebanon, PA

Leavenworth, KS

Las Vegas, NV

Asheville, NC

SPECIFIC TASKS AND DELIVERABLES

1.4 PROJECT MANAGEMENT

The Contractor shall initially utilize Essential SAFe practices for product management to deliver iteratively and incrementally which regularly produces high quality results in a cost effective, timely, and highly collaborative manner via value driven DevSecOps product lifecycle. The Contractor shall apply a DevSecOps approach that unifies software development, security, and operations; mandates collaboration across multiple IT functional divisions; prioritizes ongoing solution-oriented communication between the business and the IT organization; and develop, deliver, enhance, and manage applications and infrastructure for the business and supporting products.

1.4.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

1.4.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Conotractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

1.4.3 SECURITY AND PRIVACY

The Contractor shall provide support, applicable documentation, and coordination with Information System Security Officers (ISSOs) and Information System Owners (ISO) to ensure consistency with VA ATO (Knowledge Service eMASS) requirements for certification to ensure that the software enhancements meet VA information security policies and standards. The Contractor shall provide a Cyber Security Analysts to act as the liaison between Government ISSOs, ISOs, and contract staff.

The Contractor shall:

1. Support Field Security Services (FSS) ISSOs and Office of Cyber Security (OCS) Security Control Assessment (SCA) team for assessment requirements as detailed in VA Directive 6500 and VA Handbook 6500 Information Security Program, VA Handbook 6500.3 Assessment, Authorization, and Continuous Monitoring of VA Information Systems.

2. Conduct and participate in vulnerability scans and tests or best practice quality checks or reviews as detailed in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 4 Recommended Security Controls for Federal Information Systems and Organizations, when requested by the COR. Security scanning shall be performed by multiple methods and is done multiple times throughout the course of a product with methods such as infiltration testing (WASA), static code analysis tools (Fortify), threat modeling, Information Central Analytics and Metrics Platform (ICAMP), VA Zero Trust Architecture (ZTA),508 Testing and etc.

3. Remediate critical and high vulnerabilities identified in Government scans or quality checks or reviews.

4. Provide Vulnerability Scanning Reports and Assessments as detailed in NIST SP 800-30 Rev 1 Guide for Conducting Risk Assessments.

5. Comply with OMB Memo 11-11, the Federal CIO cybersecurity plan and VA’s enterprise cybersecurity strategy, which require migrating away from passwords to stronger two-factor authentication, specifically authentication using PIV.

6. Provide support by identifying, documenting, reviewing, and maintaining the Assessment and Authorization (A&A) Artifacts as needed to support an ATO request in accordance with VA policy and Federal Law and guidelines, as detailed in NIST SP 800-37 Rev 1 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Additionally, the Contractor shall update any aspect (e.g., documentation, code, etc.) of the development based on comments from the A&A review process conducted. A&A Artifacts include the following:

a. Privacy Impact Assessment (PIA, Privacy Threshold Analysis (PTA) (coordinate with Office of Privacy).

b. Risk Assessment (RA) (coordinate with Office of Risk Management and Incident Reporting).

c. Security Configuration Checklist (SCC).

d. System Interconnection Agreements (MOU and Interconnection).

e. Interconnection Security Agreement (ISA) as necessary.

f. Boundary Diagram

Deliverables:

A. Vulnerability Scanning Reports and Assessments B. A&A Artifacts

1.4.4 RESOURCES

The Contractor shall provide resources with a blend of specific expertise and experience in SAFe Agile, Product Management, DevSecOps, engineering, and perfective and preventive operation of products to adhere to industry standards for accomplishing the tasks outlined in this PWS.

Technical team members are required to have skills that cover the following areas to a minimum but not limited to; VistA (if application requires this) and experience with modern software development tools, cloud, VA DevOps Tool Suite (Attachment A), as well as VA Toolsets currently in use (may be subject to change as VA matures).

The Contractor shall provide cross-functional SAFe resources, as applicable, for the development of enhancements to the Revenue Operations products and underlying infrastructure in alignment with VA policies and procedures. SAFe roles include, at a minimum, the following: Release Train Engineer, Scrum Master, Tech Lead, DevSecOps Engineer/Security Specialist, Solution System Architect/Engineer, and Solution Lead.

1.4.5 PRODUCT MANAGEMENT DEVSECOPS ROLES

To support the FPL SAFe and DevSecOps maturity requirements, the Contractor shall provide key roles such as, Release Train Engineering and Security Specialization, as applicable.

Provided support shall adhere to the principles of Product Line Management, SAFe, and Information Technology Infrastructure Library (ITIL) v. 4 framework. Responsibilities shall include, at a minimum:

1. Participating in Increment Planning Sessions.

2. Coordinating schedules between development and operations teams to ensure smooth and timely releases.

3. Analyzing Agile metrics to inform VA leaderships on future planning efforts.

4. Consulting with Product Line manager and business sponsorship to align timing of releases strategically with business goals.

5. Identifying/addressing Risk/Issue in relationship to dependency management and coordination amongst the products.

1.4.6 REPORTING REQUIREMENTS

The Contractor shall use VA’s implementation of a VA-approved toolset (e.g., Jira) to provide a single Agile product lifecycle management to track execution details. The VA-approved toolset Product Data and Artifact Repository (currently GitHub) will be used to provide a single authoritative product data and artifact repository. All OIT product data and artifacts shall be required to be managed in this data and artifact repository daily. All checked out artifacts shall be checked back in daily with any data updated. The VA-approved toolset synchronizes all changed information immediately for all team members to access work proficiently without the concern of working on aged information.

The Contractor shall utilize the VA-approved toolset (currently Jira and GitHub) to:

7. Input and manage product user guides and training materials

8. Input and manage linkages in the Requirements Traceability Matrix (to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability (including bug and defect ratio per deployment)

9. Input and manage Key Metrics reporting as outlined in the Key Performance Indicators (KPIs) for DevSecOps Support

10. Measure velocity, burn-up, and burn down for each product

11. Accurately estimate points and job size over time, product increment over product increment, product team vs product team (for normalizing purposes, not to be used as a punitive measure of performance)

The Contractor shall create and maintain a Weekly Product Owner Report in Power Point of active and completed work (each week) with a link to the Key Metrics Dashboard in the VA-approved toolset (currently JIRA). These reports shall provide accurate, timely, and complete product information supporting Product Owner reporting requirements for both New Functionality/Process Improvement Initiatives and Issues. The Weekly Product Owner Report shall include, at a minimum:

New Functionality/Process Improvement Initiatives

1. Title of the Product or Process Improvement

2. Description of the Product or Process Improvement

3. Impact Statement

4. Product Owner

5. Requestor

6. RPAWG assigned Priority Level (new functionality)

7. Product Owner assigned Priority Level (process improvement initiatives)

8. Dependencies

9. Issues, Risks and Mitigation Plans

10. Date identified

11. Planned completion date

12. JIRA User Story Number

Issues

1. Title of the Issue

2. Root cause

3. Impact Statement

4. The Primary Product Owner or Lead

5. RPAWG assigned Priority Level

6. Dependencies

7. Next Steps

8. Date identified

9. Planned resolution date

10. JIRA Issue Number

The Contractor shall create and maintain a Key Metric Dashboard in the VA Agile Product Management Toolset (Jira or other VA toolset) to capture and monitor metrics related to the sprint, as well as those included in the KPIs, in addition to collated burn up, burn down, and velocity. This Key Metrics Dashboard must be available for Ad-Hoc querying by the VA to facilitate timely transmission of information. These reports shall not be the only means of communication between the Contractor and VA PM/COR to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP to the VA PM/COR during routine, regular communications built primarily around the product and product line Scrum cycle.

Deliverables:

A. Weekly Product Owner Report B. Key Metric Dashboard

1.4.7 DEVSECOPS TOOLS

The contractor shall utilize VA TRM compliant tools for all DevSecOps activities including the management, operations, and development of the products through their entire life cycle - oit.va.gov/services/trm/

1.4.8 CONFIGURATION MANAGEMENT

The Contractor shall:

1. Update the Configuration Management Database (CMDB). VHA Finance is currently using Service Now (SNOW) to identify the standard and unique aspects of configuration management (CM) to be performed for each product by establishing a VHA Finance Configuration Management Plan (CMP) which meets FPL Guidelines for CM plan and CMDB requirements. The CMDB shall serve as the central VHA Finance repository that captures delivery level artifacts. The Contractor shall reflect all CM required activities and standards in the VHA Finance CMP while determining the unique aspects of the product which require individualized procedures. This includes updating and executing the VHA Finance CMP provided by VA. The COR and VA PM will approve the CMP.

2. Deliver a Recommended List of Configuration Items, including but not limited to configuration identification, configuration control and configuration audit, as part of the VHA Finance CMP, to be placed under configuration and change control. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on FPL requirements, and the unique needs or nature of each product, the Contractor shall determine the components within each product that must be under configuration control.

3. Use a VA-approved tool and repository for all software source code and electronic artifact configuration and version management. The Contractor shall use the VA approved tool to manage change, activity, issue, action, risk, and other product data as prescribed by VA standards and processes. If assigned a product using tools that are being deprecated, the Contractor shall assist the VA Tools Team in migrating products using other Change and/or Configuration Management tools.

4. Ensure that all product software and non-software artifacts (including binaries) are versioned correctly according to VA standards and follow a PI/deployment promotion versioning approach which identifies all major, minor, and update changes to the components.

5. Create Product and Product Artifacts baselined and versioned in the VHA Finance CMDB repository to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, testing, and software product engineering documents. Maintain all baselines of software, PIs, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

6. Develop, verify and submit with all PI deliveries, a Version Description Document (VDD) that addresses the manifest of the contents of all software PIs created for product deployments outside the development environment.

7. Manage binary artifacts in the repository using industry best practice standards (e.g., snapshot, deployments).

8. Establish and maintain status reporting on change and configuration management activity and ensure VA-approved tools data records and artifacts are filed and updated daily.

9. Develop and manage a CM process that supports all necessary changes for the product including changes to Definition of Done, Acceptance Criteria and any other items deemed necessary.

Deliverables:

A. Configuration Management Database B. VHA Finance Configuration Management Plan (CMP) C. Version Description Document

1.5 REVENUE OPERATIONS WORKFLOW FUNCTIONALITY AND CLOUD COMPUTING

Revenue operations requires an operational user-based workflow tool. The tool works to automate and manage repeatable, predictable business processes to ensure consistency, reduce errors and gain efficiency across the business line.

The Contractor shall provide healthcare revenue workflow management, robotic process automation or RPA, and licenses, that can be used to sustain and exceed the overall objectives of the CPAC operations model. Combined, the tools shall support CPAC goals for improving the performance of revenue collections. The healthcare revenue workflow and payer compliance tools shall generate workflow items for manual review and distribution to staff. The RPA tools shall provide automation assistance to approved work processes that reduce manual staff intervention. The healthcare revenue workflow management, RPA, and payer compliance tools shall support the CPAC goals for continuously improving the performance of revenue collections with an electronic mechanism to assist in the prioritization, distribution, tracking and reporting of daily workload associated with the CPAC Revenue Cycle. The revenue collection workflow management, RPA, and payer compliance tools shall increase organizational productivity and revenue cash flow.

The contractor shall build, provide and implement a cloud computing migration plan. It is expected that the vendor works closely and often with Revenue Operations and their Information technology teammates to ensure an effective plan and implementation of cloud computing functionality. The contractor manages its build and product delivery process alongside and with guidance from the Revenue Process Automation Work Group (RPAWG), a key programmatic element of the Revenue Operations governance process.

1. Cloud computing migration plan must be provided to VA within 90 days of award. The plan must include:

a. Data migration

b. Data ownership

c. Data security

d. Data flow and return – VA retains full ownership of data at all times.

e. Performance and Metrics

f. System Downtime and Business Continuity

g. Intellectual Property and Tool usage

h. Comprehensive future state architecture…