36C24723Q0208.docx

36C24723Q0208

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE

DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a.

PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE

ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26.

TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212

-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNAT

URE OF OFFEROR/CONTRACTOR

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

534-23-1-869-0001 36C24723Q0208 11-08-2022 Jessica Cummings Jessica.Cummings3@va.gov 12-23-2022

12PM

EST

508A

DEPARTMENT OF VETERANS AFFAIRS

VETERANS HEALTH ADMINISTRATION

Network Contracting Office (NCO) 7 2957 CLAIRMONT ROAD NE, Suite 1200 Atlanta GA 30329 X 541990 $17 Million N/A X See delivery Schedule

508A

DEPARTMENT OF VETERANS AFFAIRS

VETERANS HEALTH ADMINISTRATION

Network Contracting Office (NCO) 7 2957 CLAIRMONT ROAD NE, Suite 1200 Atlanta GA 30329

508A Department of Veterans Affairs

FMS-VA-2(101)

Financial Services Center PO Box 149971 Austin TX 78714-0071 See CONTINUATION Page Health Information Exchange Subscription Ralph H. Johnson VA Medical Center Period of Performance Base: 11/1/2022 – 10/31/2023 Option Year 1: 11/1/2023 – 10/31/2024 Option Year 2: 11/1/2024 – 10/31/2025 Option Year 3:

11/1/2025 – 10/31/2026 Option Option Year 4: 11/1/2026 – 10/31/2027 Clause 54.217-5 Please contact Jessica Cummings for any information.

Email: Jessica.Cummings3@va.gov See CONTINUATION Page 534-3630160-869-820100-2560 0100J5020 x X x Earnest Ellison Contract Officer Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

f

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C247 Earnest Ellison

DEPARTMENT OF VETERANS AFFAIRS

VETERANS HEALTH ADMINISTRATION

Network Contracting Office (NCO) 7 2957 CLAIRMONT ROAD NE, Suite 1200 Atlanta GA 30329

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs FMS-VA-2(101), Financial Services Center, PO Box 149971, Austin TX 78714-9971 ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

Page 1 of

STATEMENT OF WORK

HEALTH INFORMATION EXCHANGE SUBSCRIPTION

DESCRIPTION OF SERVICES

The subscription and servicing of this subscription with the only approved South Carolina Health Information Exchange, which is serviced by the Carolina ehealth Alliance (CeHA), will provide the Ralph H. Johnson VA Medical Center (RHJVAMC) with access to a secure cloud-based portal to bidirectionally share and obtain real time, critical veteran clinical care data from South Carolina Health systemsthe South Carolina Health Information Exchange. outside the VA.

PERIOD OF PERFORMANCE

This contract will be awarded as a yearly subscription. The first-year cost includes support from the CeHA team to help our team set up this secure cloud-based connection. This will be a recurring yearly subscription where they CeHA team will maintain the secure cloud-based system and trouble shoot any issues with log in, access and sharing data when needed. The subscription will occur from date of signed contract (to be determined) for a 12-month period of time from this date. Exact dates of service will be determined and agreed upon by RHJVAMC and CeHA following contract award.

Base Year POP: 121/301/2022 – 120/2931/2023 Option Year 1 POP: 121/301/2023 – 120/2931/2024 Option Year 2 POP: 121/301/2024 – 120/2931/2025 Option Year 3 POP: 121/130/2025 – 120/2931/2026 Option Year 4 POP: 121/301/2026 – 120/2931/20276

PLACE OF PERFORMANCE

Ralph H. Johnson VA Medical Center 109 Bee Street Charleston, SC 29401

SCOPE

1. Access to the only approved South Carolina Health Information exchange, serviced through CeHA based electronic health information exchange for bidirectional data exchange.

2. It is required that only the single, direct entity approved to service the South Carolina Health Information exchange is the sole operator for training, implementation, data exchange, infrastructure set up, maintenance and security of this subscription.

The Sole South Carolina Health Information exchange, serviced by CeHA, health information exchange will provide RHJVAMC with reduction in the following patient safety errors:

· Veterans having duplicative care (scans, testing, labs costing money), avoidable admissions in outside facilities due to lack of records

· Quality- Fragmented care and increased errors because of lack of access, medication list, allergies.

· When you have access to HIE the ED length of stay is reduced by 40% admitted mostly by avoiding CT scan done the prior day. Sickle cell patients having information on baseline hemoglobin.

· Community acquired pneumonia- put on antibiotics and failed it but put on the same antibiotic because no timely record access.

· High numbers of canceled and delayed consults due to lack of record access from other facilities

· CeHA will have statewide healthcare system coverage by October 2022

1.1 Authority

The authority for this interconnection is based on:

· Federal Information Security Modernization Act (FISMA)

· NIST 800-47, Security Guide for Interconnecting Information Technology Systems

· VA Directive and Handbook 6513, Secure External Connections

· VA Directive 6500, VA Directive 6500: VA Cybersecurity Program, and Handbook 6500, Risk Management Framework for VA Information Systems: Tier 3 – VA Information Security Program

· Health Insurance Portability and Accountability Act (HIPAA) Security Rule, 45 C.F.R. Part 160

· 38 United States Code (U.S.C.) §§ 5721-5728, Veteran’s Benefits, Information Security

· OMB Circular A-130, Managing Information as a Strategic Resource

· 18 U.S.C. 641 Criminal Code: Public Money, Property or Records

· 18 U.S.C. 1905 Criminal Code: Disclosure of Confidential Information

The authority for RHJVAHCS to share data for the purpose outlined under this Agreement with SCHIP is as follows:

· HIPAA Privacy Rule, 45 Code of Federal Regulations (C.F.R.) Part 164, Standards for Privacy of Individually Identifiable Health Information

· Privacy Act of 1974, 5 U.S.C. § 552a, as amended

· VA, 24VA10A7; Routine Use #29

· VA Claims Confidentiality Statute, 38 U.S.C § 5701

· Confidentiality of Certain Medical Records, 38 U.S.C. § 7332

Each IT system is described below:

RHJVAHCS’s System

– Name Computerized Patient Record System (CPRS)

– Function CPRS is a comprehensive Veterans Health Information System and Technology Architecture, which allows clinicians and others to enter and view orders, Progress Notes and Discharge Summaries (through a link with TIU), Problem List, view results, reports (including health summaries), etc.

– Location 109 Bee St, Charleston, SC 29401

SCHIP’s System

– Name South Caroline Health Information Exchange (SCHIEx)

– Function The only approved South Carolina Health Information exchange platform (SCHIEx) platform will allow the Ralph H. Johnson VA Healthcare Center to view clinical documents from other covered entities, who participate in the CeHA HIE (also referred to herein as the CeHA Participants), to improve patient care and to reduce cost by leveraging information already gathered in connection with any such patient. The CeHA Participants will be able to view clinical documents from the Ralph H. Johnson VA Healthcare Center for identical purposes. In all instances no health record of a patient may be viewed by any CeHA Participants absent advance consent of such patient. Upon the transfer of a health record of a patient from one CeHA Participants to another CeHA Participants by and through SCHIEx, with advance patient consent, the receiving CeHA Participants shall be solely responsible for any patient health record in its custody, and any subsequent breach of such patient’s health records in the custody of the receiving CeHA Participants shall not be the responsibility of the transferring CeHA Participants, from which the data originated, nor any business associate, such as SCHIP, that facilitated the transfer of the patient’s health record.

As between RHJVAHCS and SCHIP, RHJVAHCS shall be solely responsible, at all times, for its activities and performance related to and in connection with the DEA, except to the extent of the activities and performance of SCHIP as a business associated of RHJVAHCS in connection therewith.

– Location 3790 Fernandina Road, Suite 301, Columbia, SC 29210

1.2 Communications

Frequent formal communications are essential to ensure the successful management and operation of the interconnection. The parties agree to maintain open lines of communication between designated staff at both the managerial and technical levels. Communications described herein must be conducted in writing (mail or email, excluding any sensitive VA information) unless otherwise noted.

The owners of RHJVAHCS’s CPRS and SCHIP’s SCHIEx agree to designate and provide contact information for the technical lead(s) for their respective system and to facilitate direct contact between technical leads to support the management and operation of the interconnection (see Appendix A). To safeguard the confidentiality, integrity, and availability of the connected systems and the data stored, processed, and transmitted, the parties agree to provide notice of specific events within the timeframes indicated below.

1.2.1 Security Incidents

For the purposes contemplated herein, SCHIP and RHJVAHCS agree to be bound by that certain business associate agreement attached hereto and incorporated herein (the BAA). In the event of conflict between this MOU and the BAA shall control.

If SCHIP employee, contractor, or agent becomes aware of the theft, loss, or compromise of any device of SCHIP used to transport, access, or store VA data, SCHIP shall notify RHJVAHCS POCs listed in Appendix A by telephone or email in accordance with the BAA.

SCHIP will provide details of the security incident, the potential risk to VA data, and all actions taken to remediate the issue. Reportable items include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. VA Information System Security Officers (ISSO) or Privacy Officers (PO) will contact VA-CSOC within one hour of notification.

SCHIP will also provide VA with a written closing action report once the security event or incident has been resolved. Designated POCs will follow established incident response and reporting procedures, determine whether the incident warrants escalation, and comply with established escalation requirements for responding to security incidents.

RHJVAHCS will report security incidents to the SCHIP POCs listed in Appendix A.

In the event that pursuant to a patient’s authorization in accordance with applicable law, including HIPAA, to transfer such patient’s health record, including any PHI, PII, and IIHI to RHJVAHCS, RHJVAHCS shall solely be responsible for such health record in its custody following such transfer, subject to applicable law. Correspondingly, in the event that pursuant to a patient’s authorization in accordance with applicable law, including HIPAA, to transfer such patient’s health record, including any PHI, PII, and IIHI to SCHIEx for transmission to a CeHA Participant, such the CeHA Participant shall solely be responsible for such health record in its custody following such transfer, subject to applicable law.

1.2.2 Disasters and Other Contingencies

Technical staff will immediately notify their designated counterparts listed within Appendix A by telephone or email in the event of a disaster or other incident that disrupts the normal operation of one or both connected systems.

1.2.3 Material Changes to System Configuration

A significant change to an information system may include changes to the system itself or to the environment of operation. Significant changes to the information system may include but are not limited to: installation of new or major upgrades to the operating system, middleware component, or application; modifications to system ports, protocols, or services (see Appendix C); installation of a new or upgraded hardware platform; modifications to cryptographic modules or services; or modifications to security controls. Significant changes to the environment of operation which materially impact the interconnection to require reporting, may include, but are not limited to: moving to a new facility; adding new core missions or business functions; acquiring specific and credible threat information that the organization is being targeted by a threat source; or establishing new or modified laws, policies or regulations. Major changes to the information collected or maintained are those changes that could result in greater disclosure of information or a change in the way personal information/data is used.

Planned technical changes to the system architecture will be coordinated with the appropriate security and technical staff. All changes must be submitted, approved, and implemented as a modification to the existing connection through the appropriate change management process. Prior to requesting or implementing a change to the interconnection, the System Owner will conduct a risk assessment based on the new system architecture and determine if the proposed change requires reauthorization of the interconnection. Formal reauthorization is required whenever a system undergoes a significant change. The SOW must be updated and re-signed within 30 calendar days of implementation.

1.2.4 New Interconnections

The initiating party will notify the other party at least 30 calendar days before it connects its IT system, described in Section 2.1, with any other IT system that materially impacts the security of the interconnection covered by this SOW. This includes connecting the IT system with systems that are owned and operated by third parties.

1.2.5 Personnel Changes

The responsible parties for each system are listed in Appendix A. The parties agree to provide notification of the separation, long-term absence or any other significant status changes in user profiles or personnel listed in Appendix A. The appendix will be updated as necessary to ensure accuracy.

Updating Appendix A does not require the re-signing of this SOW by either party. It is the responsibility of each respective approving authority to ensure the timely updating of this appendix and for the notification of such changes to the alternate party within thirty (30) days of any personnel change.

1.2.6 Security

Both parties agree to work together to ensure the joint security of the connected systems and the information/data stored, processed, and transmitted, as specified in the ISA section of this document.

1.2.7 Cost Considerations

Both parties agree to share the costs of the interconnecting mechanisms and/or media. Percentage of cost assumed by each organization (e.g., 50/50, 40/60, etc.) must be agreed upon in advance, and no such expenditures or financial commitments shall be made without the written concurrence of both parties. Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system owner’s organization.

2 INTERCONNECTION SECURITY REQUIREMENTS

2.1 Background

The technical details of the interconnection are detailed in this ISA section of the document. The parties agree to work together to develop the ISA section. The SOW must be signed by both parties before the interconnection is activated. Proposed changes to either system or the interconnecting medium will be reviewed and evaluated as outlined in Section 2.2.3 Material Changes to System Configuration and 2.2.4 New Interconnections. The SOW must be updated and re-signed within 30 calendar days before changes (as described in Section 2.2.3 and 2.2.4) are implemented. Signatories to the SOW shall be the RHJVAHCS System Owner, ISSO and PO and at least one (1) SCHIP System Owner. The document will become an integral piece of the VA Assessment and Authorization (A&A) documentation and will be included in subsequent authorization requests.

2.1.1 System Description

RHJVAHCS’s CPRS System and SCHIP’s SCHIEx System descriptions are listed in Section 2.1 of this document.

2.1.2 System Hardware and Software Requirements

There are no special hardware requirements to support this application Software requirements include:

· Safari 7 or newer for the providers to gain access to the HIE (a full list of supported browsers can be referenced in the attached document ROS_ORGANIZE_CHR_7.5.7.2_Final document.)

· Certificate-based authentication will be used to establish connection between SCRPS and SCHIEx.

· SAML will be used to support SSN.

2.2 System Security Considerations

2.2.1 General Information/Data Description

RHJVAHCS System

The following is a description of information/data to be transmitted from RHJVAHCS to SCHIP including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level.

· Information Type Transmitted RHJVAHCS will establish 5 feeds (ADT, Labs, RAD, Path, and Trans) and utilize Single Sign-on to connect to SCHIP. These feeds will include real-time clinical data sourced from CRISP to include the registration, visit and labs from patients as they are processed through the medical center

· Data Flow Description A certificate-based solution will be used to transmit the PHI data from RHJVAHCS to SCHIP. The data will be stored by the software vendor, Health Catalyst in Salt Lake City, UT, for use in the Community Health Record (CHR), the product licensed by SCHIEx for the Health Information Exchange solution.

· The FIPS 199 Sensitivity Categorization Level is High.

· Confidentiality –High

· Integrity - High

· Availability High

SCHIP System

The following is a description of information/data to be transmitted from SCHIP to RHJVAHCS including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level.

· Information Type Transmitted: SCHIP will transmit PII and PHI to the RHJVAHCS CPRS for patient care.

· Data Flow Description: SCHIP will use Single Source Sign On following the SAML protocol to connect the RHJVAHCS CPRS to create a streamlined workflow for providers to quickly access patient medical data from other health care providers in the SCHIEx network.

· The FIPS 199 Sensitivity Categorization Level is High.

· Confidentiality –High

· Integrity - High

· Availability High

The interconnection between CPRS and SCHIEx is a two-way path.

Purpose for Data Transfer: The SCHIEx health information exchange will provide RHJVAHCS with reduction in the following patient safety errors:

· Veterans having duplicative care (scans, testing, labs costing money), avoidable admissions in outside facilities due to lack of records

· Quality- Fragmented care and increased errors because of lack of access, medication list, allergies.

· When you have access to HIE the ED length of stay is reduced by 40% admitted mostly by avoiding CT scan done the prior day. Sickle cell patients having information on baseline hemoglobin.

· Community acquired pneumonia- put on antibiotics and failed it but put on the same antibiotic because no timely record access.

· High numbers of canceled and delayed consults due to lack of record access from other facilities VA-owned data transmitted to SCHIP via this interconnection is physically stored at the Health Catalyst data center in Salt Lake City, UT, US. (Server names will not be available until development is underway.)

Provisions for Destruction or Return of the Data (if applicable): The VA data are to remain available through the HIE until RHJVAHCS or SCHIEx requests the deletion of the data.

2.2.2 Security Assessment

RHJVAHCS

The RHJVAHCS participates in annual risk assessments for quality control measures. The Business Risk Division conducts provides comprehensive annual reviews in conjunction with the ISSO to ensure all MOUs are adhered to.

SCHIP

The technology embodied in the SCHIEx Platform to facilitate the CeHA HIE is Health Catalyst Interoperability: HCI Application Suite, consisting of HCI Connect, HCI Notify, HCI Exchange, HCI Organize, and HCI Explore (collectively, Health Catalyst), which has been assessed effective as of October 16, 2020, and meets the HITRUST CSF® v9.2 certification. Such assessment and certification remain in place for two years.

2.2.3 Services Offered

SCHIP offers a connection to the CeHA HIE by and through the Health Catalyst technology.

2.2.4 Information System Security Officer at Interconnection Site There must be an established ISSO (or business partner equivalent) at all interconnection sites described herein, to provide oversight through the duration of the system development lifecycle (SDLC) phases (development, deployment, operations, and disposal) of the interconnection and to ensure that the systems maintain appropriate security controls. ISSO (or business partner equivalent) contact information is listed in Appendix A.

2.2.5 Sensitivity Categorization

Refer to Section 3.2.1 of this document.

2.2.6 User Community

The minimum requirements for employees to work in support of this interconnection, to include background investigations and security clearances, will be determined by the contract(s) or requirements governing the support services provided by the vendor. SCHIP will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts or requirements and for continuously monitoring and tracking the status of all SCHIP employees relevant to this interconnection.

The community of users from RHJVAHCS and/or SCHIP that will transmit, access, exchange, and/or receive data across the interconnection as described in section 2.1 are doctors providing patient care.

2.2.7 Information Exchange Security

The security of VA sensitive information (see Appendix B for definition of sensitive information) being transmitted, processed, or stored over any system and interconnection in support of this agreement must be FIPS 140-2 (or successor) compliant. The FIPS 140-2 compliance is not required if no VA sensitive data is transmitted. RHJVAHCS sensitive information as defined in Appendix B will be transmitted.

The FIPS 140-2 certificate number of SCHIP's gateway cryptographic module for establishing the Virtual Private Network (VPN) tunnel is FIPS# [enter current valid certificate number# [Health Catalyst maintains the HITRUST Certification which includes the FIPS 140-2 required elements. See attached for reference. FIPS compliance will be validated by RHJVAHCS.

The connections at each end must be located within controlled access facilities using physical access control devices and/or guards. Individual users will not have access to the data except through the system security software inherent to the operating system. Access is controlled by authentication methods to validate the approved users.

2.2.8 Trusted Behavior Expectations

RHJVAHCS's system and users are expected to protect SCHIEx, and SCHIP’s system and users are expected to protect CPRS in accordance with the Privacy Act and Trade Secrets Act (18 U.S.C. 1905), the Unauthorized Access Act (18 U.S.C. 2701 and 2710), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and other applicable laws and policies referenced in Section 1.1 of this document.

2.2.9 Formal Security Policy

Policies that govern the protection of the information/data for RHJVAHCS include but are not limited to VA Directive and Handbook 6500 (or successors). Policies that govern the protection of the information/data for SCHIP's include but are not limited to SCHIEx_Information Security Policy 2021-08, attached. All documents are available upon request.

2.2.10 Audit Trail Responsibilities

Both parties are responsible for auditing application processes and user activities involving the interconnection with enough granularity to allow successful investigation of any breaches and security incidents. Activities that will be recorded include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. Audit logs will be retained for a minimum of one (1) year or as documented in the National Archives and Records Administration (NARA) retention periods, HIPAA legislation or whichever is greater. Audit logs which describe a security breach must be maintained for six (6) years. Those responsible for maintaining audit logs must ensure that audit logs are successfully stored for the required duration.

Additional terms regarding audits related to the CeHA HIE are contained in the DEA.

2.2.11 Security Parameters

The following detailed security measures and controls implemented by each organization to protect the confidentiality, integrity, and availability of the connected systems and the information/data that will pass between them are outlined below:

RHJVAHCS implements the following security measures and controls:

· Identification and Authentication - User Access control is managed by strong authentication method and must be assigned on the "Least Privilege" Principal. VA utilizes “two-factor authentication” for general users. A separate token and non-mail enabled account is required for users who require elevated privileges on IT systems.

· Logical Access Controls - VA accounts are separated into domains and the system administrators only manage those accounts within their domain. Accounts are audited every ninety (90) days. VA policy requires account termination within twenty-four (24) hours of an employee/contractor departure. Accounts are terminated immediately in the event of a hostile termination.

· Physical and Environmental Security - Physical and environmental controls are maintained at VA facilities. Badges are required for employees and contract staff. Access to networking closets and computer rooms require authorization from the facility Chief Information Officer (CIO) and a log is maintained. VA computer rooms are environmentally controlled for operation of the equipment is contains. This includes power; network; heating, ventilation, and air conditioning (HVAC); and fire suppression.

· Firewall, IDS, and Encryption - Intrusion detection systems (IDS) are in place at gateways and throughout the VA network. The VA’s Cybersecurity Operations Center monitors the VA network 24x7. Suspicious activity is reviewed and determined recommendations are formulated and assigned to the system administrators. FIPS 140-2 validated encryption is required for transmission of sensitive information.

SCHIP implements the following security measures and controls: The following security measures and controls are certified through HITRUST CSF® v9.2 and the Type II System and Organization Controls Report (SOC 2) to ensure proper safeguards are in place.

Identification and Authentication: Multi-factor authentication (MFA) is required for all remote access in all divisions, and the organization implements MFA using VPN-based authentication with tokens or through native MFA support in Aptible, Azure, and AWS. Passwords and sensitive data are encrypted during storage and transmission. Authentication is governed by AD, JumpCloud, and AWS. For applications hosted by the organization, most implement single sign-on with client environments and the others implement modern authentication libraries that provide password hashing for storage and leverage HTTPS encryption for transmission. All applications implement HTTPS for protection of credentials in transmission and store passwords using commercially available and current authentication libraries that implement hashing.

Logical Access Controls: Health Catalyst implements logical access security measures to protect against threats from sources outside its system boundaries to include but not limited to:.

· Maintains a data flow diagram to monitor and track the movement of its data.

· Has requirements for configuring and implementing firewalls based on industry standards.

· Has specific authentication measures to secure passwords and credentials.

· Uses multi-factor authentication (MFA) to secure and protect employee access and organizational data

Physical and Environmental Security Health Catalyst restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives. The following environmental protections are audited for compliance: Considerations for power, cooling, and humidity and the protection from fire risks.

Firewall, IDS, and Encryption CC7.1: Health Catalyst manages firewalls through change management tickets and implements firewalls at each internet gateway point between SDEs. Health Catalyst DOS and Interoperability divisions maintain traditional Sophos XG and Cisco firewall deployments while Healthfinch and Able Health implement network security groups for network traffic management. The organization bases its encryption standards on Azure and AWS best practices. Data storage never physically leaves the organization’s colocation or cloud service facilities on media. All transmissions across networks are protected by hypertext transfer protocol secure (HTTPS), Secure Shell protocol (SSH), and Internet Protocol Security (IPsec) tunnels.

Training and Awareness The training and rules of behavior requirements for employees who work in support of this interconnection will be determined by the contract(s) or requirements governing the support services provided. SCHIP will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts and for continuously monitoring and tracking the status of all SCHIP employees relevant to this interconnection.

2.3 TOPOLOGICAL DRAWING

3 Duration This agreement will expire when RHJVAHCS’s participation in the DEA is terminated as provided in Article 12 of the DEA or its business associate agreement with either SCHIP or CeHA is terminated.

Annually, the VA ISSO, along with the System Owner, will review the agreement to ascertain 1) if the interconnection is still necessary and 2) if there are any significant changes to the interconnection (see section 2.2.3 Material Changes to System Configuration). The outcome of the review will be documented in the SOW Review Form. If there are significant changes to the interconnection at any time or if major changes were noted during the annual review, the agreement must be updated and re-signed.

Approval to decommission an interconnection must come from the VA Authorizing Official/System Owner.

5. Fees and Expenses. On behalf of CeHA, SCHIP shall invoice RHJVAHCS for payment of fees associated with access and use of the CeHA Health Information Exchange, and its connection thereto through SCHIEx, for the remainder of the fiscal year ending June 30, 2022. Thereafter, SCHIP shall invoice RHJVAHCS on an annual basis and payment shall be due to SCHIP care of CeHA within thirty (30) calendar days following the invoice date. Any payment due to CeHA shall be tendered in the form of a check payable to SCHIP care of Carolina eHealth Alliance and delivered to the address set forth on the invoice, or by wire transfer of funds to an account designated by CeHA.

3. OFF-SITE SERVICES

CeHA will be charged with maintaining the cloud-based server exchange and security expectations. They will also be providing our team with implementation support and system set up assistance during this contract.

4. ON-SITE SERVICES

The CeHA team will be providing implementation support either in person or remotely to our Clinical application coordinator teams and our OIT teams.

GENERAL REQUIREMENTS

1. CHANGES TO THE STATEMENT OF WORK

Any changes to the SOW will be authorized and approved only through written correspondence from the Contracting Officer. A copy of each change will be maintained in a project folder, along with all other documents related to the project. Costs incurred by CeHA through any action of parties, other than the Contracting Officer, will be the responsibility of the consultant(s).

2. REPORTING REQUIREMENTS

The consultant(s) will maintain all necessary security standards to fulfill the contract. The consultant(s) will provide the Contracting Officer with a copy of proof of security standards, and/or documentation required.

3. TRAVEL

CeHA are responsible for any and all travel and/or per diem to and from RHJVAMC. All on-site work will be conducted at the facility:

Ralph H. Johnson VA Medical Center 109 Bee Street Charleston, SC 29401

4. GOVERNMENT RESPONSIBILITIES

RHJVAMC will grant the consultant(s) permission to perform supportive site visits at RHJVAMC – 109 Bee Street, Charleston, SC.

RHJVAMC will grant the consultant(s) facility access deemed necessary to provide the services required under this contract, Monday through Friday from 7:00am to 4:00pm, excluding Federal Holidays.

5. CONSULTANT EXPERIENCE REQUIREMENTS

The consultant(s) will be authorized provider(s) of the services specified.

6. CONTRACTING OFFICER’S REPRESENTATIVE

The RHJVAMC representative of the Contracting Office will be designated to represent the Contracting Officer in furnishing technical guidance and advice regarding the work to be performed under this contract. Delegation of Authority letter(s) will be forwarded to the consultant(s) prior to commencement of the contract, identifying the individual(s) as the COR(s). All authorized representatives of RHJVAMC to order services and/or accept and reject services performed will be delegated as COR(s). No service may be provided without the approval of the COR(s).

7. CONSULTANT PERSONNEL SECURITY REQUIREMENTS

It is agreed that:

All personnel will provide any and all required and/or requested documentation to gain access at RHJVAMC.

The consultant(s) will receive any necessary access badges for the facility and/or be escorted during site visits by a RHJVAMC employee.

No photography on RHJVAMC premises is allowed.

8. CONFIDENTIALITY AND NON-DISCLOSURE

It is agreed that:

The preliminary and final deliverables, and all associated working papers, application source code, and other materials deemed relevant by RHJVAMC which have been generated by the consultant(s) in the performance of this task order, are the exclusive property of the US Government and will be submitted to the Contracting Officer within seven (7) days of the conclusion of the period of performance. At the conclusion of the task order, all submittals will be audited by RHJVAMC in conjunction with the consultant(s).

The Contracting Officer will be the sole, authorized official to release, verbally or in writing, any data, draft deliverables, or final deliverables pertaining to this task order. No information will be released by the consultant(s).

Appendix A: Points of Contact List of Responsible Parties for Each System:

Cole Zanetti, DO, MPH

GFE: (803) 979-3410 (Monday-Friday)

Yancy.mcpherson@va.gov

Office: (843) 789-7767

Clinton.stucker@va.gov

List of Responsible Parties to Contact during a Security Incident:

support@healthcatalyst.atlassian.net

Kenneth R. Deans Jr.

* Note: VA-CSOC should only be contacted by VA personnel.

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

CeHA Annual Subscription Fees (152) beds - Contract Period: Base POP Begin: 12-30-2022 POP End: 12-29-2023

Vendor Estimate # 1002 CeHA One-Time Implementation Fee Includes: 5 feeds (ADT, Labs, RAD, Path, and Trans); Single Sign-on (HIE side configuration); Project personnel Contract Period: Base POP Begin: 12-30-2022 POP End: 12-29-2023

CeHA Annual Subscription Fees (152) beds - Contract Period: Option 1 POP Begin: 12-30-2023 POP End: 12-29-2024

CeHA Annual Subscription Fees (152) beds - Contract Period: Option 2 POP Begin: 12-30-2024 POP End: 12-29-2025

CeHA Annual Subscription Fees (152) beds - Contract Period: Option 3 POP Begin: 12-30-2025 POP End: 12-29-2026

CeHA Annual Subscription Fees (152) beds - Contract Period: Option 4 POP Begin: 12-30-2026 POP End: 12-29-2027

B.3 DELIVERY SCHEDULE

1.00

1.00

1.00

1.00

1.00

1.00

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2021)

(a) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government must exercise its post-acceptance rights—

(1) Within a reasonable time after the defect was discovered or should have been discovered; and

(2) Before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item.

(b) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Governmentwide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract.

(c) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

(d) Disputes. This contract is subject to 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at Federal Acquisition Regulation (FAR) 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(e) Definitions. The clause at FAR 52.202-1, Definitions, is incorporated herein by reference.

(f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence such as, acts of God or the public enemy, acts of the Government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers. The Contractor shall notify the Contracting Officer in writing as soon as it is reasonably possible after the commencement of any excusable delay, setting forth the full particulars in connection therewith, shall remedy such occurrence with all reasonable dispatch, and shall promptly give written notice to the Contracting Officer of the cessation of such occurrence.

(g) Invoice.

(1) The Contractor shall submit an original invoice and three copies (or electronic invoice, if authorized) to the address designated in the contract to receive invoices. An invoice must include—

(i) Name and address of the Contractor;

(ii) Invoice date and number;

(iii) Contract number, line item number and, if applicable, the order number;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice; and

(ix) Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this contract.

(x) Electronic funds transfer (EFT) banking information.

(A) The Contractor shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer—System for Award Management, or 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(2) Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR part 1315.

(h) Patent indemnity. The Contractor shall indemnify the Government and its officers, employees and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark or copyright, arising out of the performance of this contract, provided the Contractor is reasonably notified of such claims and proceedings.

(i) Payment.—

(1) Items accepted. Payment shall be made for items accepted by the Government that have been delivered to the delivery destinations set forth in this contract.

(2) Prompt payment. The Government will make payment in accordance with the Prompt Payment Act (31 U.S.C. 3903) and prompt payment regulations at 5 CFR part 1315.

(3) Electronic Funds Transfer (EFT). If the Government makes payment by EFT, see 52.212-5(b) for the appropriate EFT clause.

(4) Discount. In connection with any discount offered for early payment, time shall be computed from the date of the invoice. For the purpose of computing the discount earned, payment shall be considered to have been made on the date which appears on the payment check or the specified payment date if an electronic funds transfer payment is made.

(5) Overpayments. If the Contractor becomes aware of a duplicate contract financing or invoice payment or that the Government has otherwise overpaid on a contract financing or invoice payment, the Contractor shall—

(i) Remit the overpayment amount to the payment office cited in the contract along with a description of the overpayment including the—

(A) Circumstances of…