36C77619Q0157-001.docx

HI19-17 Health IT Safety Assessment

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Health Informatics (OHI) Health Informatics (HI) Informatics Patient Safety (IPS)

HI19-17

Health IT Safety Assessment

Date: 3/11/19 PWS Version Number: 3.1

Contents

BACKGROUND

Within the Veterans Health Administration (VHA), the Office of Health Informatics (OHI), Informatics Patient Safety (IPS) Office takes a leadership role in promoting the safety of health information technology (HIT) products, while promoting high quality safety-enhanced delivery of HIT products. The ability to identify risks for internal and external HIT stakeholders using HIT products is crucial to the use of HIT to provide safer care of our Veterans. IPS is considered the VHA lead for investigation and analysis of HIT patient safety concerns. In addition, IPS represents VHA among federal and private organizations to develop HIT patient safety improvement, such as input to policy and best practices. The purpose of this contract is to obtain patient safety support for the VHA, OHI, IPS office. This support will enable the continued provisioning of patient safety services by IPS to other VHA program offices as well as support for IPS-initiated analyses. While occasional organizational changes may occur, the scope of this contract is intended to include the projects and programs listed below as well as new ones that may emerge:

1. VA Legacy Systems: Consists of support for program offices that maintain and enhance VHA’s legacy HIT systems, specifically VistA and the Computerized Patient Record System (CPRS).

2. Clinical Informatics and Data Management Office (CIDMO): Comprised of entities such as Interoperability, Bar Code Resource Office (BCRO), Human Factors Engineering (HFE), Chief Nursing Informatics Office (CNIO) that periodically request services from IPS.

3. Other VA Program Offices: IPS conducts Causal Analysis and Healthcare Failure Mode and Effect Analysis (HFMEAs) for various programs, and participates in creation of Alerts/Advisories with National Center for Patient Safety (NCPS)

4. VA Field Offices: Field offices develop and deploy solutions for local or VISN-wide use and occasionally request IPS consultation and/or review.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following agency specific Directives and Procedures and a copy of these items are electronically available to the contractor as a part of the solicitation:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

13. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

23. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

25. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

26. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010

28. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

29. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

34. VA Directive 6300, Records and Information Management, February 26, 2009

35. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

36. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 10, 2014

37. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

38. OMB Memorandum, “Transition to IPv6”, September 28, 2010

39. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

40. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

41. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

42. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

43. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

44. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

45. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

46. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

47. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

48. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

49. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

50. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

51. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

52. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

53. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

56. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

57. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

58. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

59. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

60. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

61. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

62. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

63. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

64. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

65. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

66. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

68. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

71. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

72. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

73. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

74. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

SCOPE OF WORK

The Contractor shall provide all resources necessary to perform the tasks and deliverables in this Performance Work Statement. The Contractor shall respond to patient safety risks and provide support to the IPS Office in the form of analysis, workflow documentation, process reviews, and mitigation/remediation recommendations. The Contractor shall provide technical support in the assessment of HIT safety products. The Contractor shall provide user interaction/experience design related to patient safety. The Contractor shall take into account systems design/architecture, human/technical failures, human factors engineering, safety culture, and error reporting and analysis in the consideration of three goals: analysis for safer Health IT, use Health IT safely, and use Health IT to improve safer care. In addition, the Contractor shall apply reporting mechanisms for post-deployment monitoring of HIT safety.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance shall be one (1) twelve (12) month base period, with four (4) 12-month option periods (if exercised).

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities.

TRAVEL

Occasional travel shall be required. Travel costs shall be included as a separate, cost-reimbursable, “not to exceed” line item.

The contractor must obtain written approval from the VA PM (or the designated back-up when the VA PM is out of the office) and VA COR before any travel begins, utilizing Attachment N, Travel Authorization Request in Section D of solicitation. Travel and per diem expenses shall be approved and paid on an actual expenditures basis in accordance with Federal Travel Regulations and FAR 31.205-46. Travel that occurs without written pre-approval shall NOT be reimbursed. The contractor MUST use Attachment N for travel pre-approval. Other documents or e-mails shall NOT be accepted as pre-approval.

In order to be paid for travel, the contractor shall submit supporting documentation as required by Federal Travel Regulations with invoices. Federal Travel Regulations require receipts for travel expenditures of $75.00 or more. Expenses for subsistence and lodging shall be approved and paid to the contractor only to the extent where an overnight stay is necessary and authorized by Federal Travel Regulations in effect at the time of the stay for the specific location. Additional information can be found at:

http://www.gsa.gov/portal/category/21287.

Travel shall be in accordance with the Federal Travel Regulations (FTR). Contractor travel within the local commuting area will not be reimbursed.

An estimation of travel requirements is listed below. This estimation should be used in developing the travel price quote by the contractor.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the tasks and complete the associated deliverables by the scheduled delivery dates. The quantities and due dates represent an overall average based on historical data and are to be used in estimating the level of effort required over the period of performance. Assignments are generated when the IPS Office is notified of a potential risk event or a request for collaboration on an internal or external project is received. While deliverables are expected to be actionable and highly operational in nature, some of them may also be synthesized with other data and used to inform strategic direction. The Contractor shall execute IPS activities in accordance with published VHA IPS office methods, processes, and report formats where available. If VA does not currently have the aforementioned artifacts, the Contractor shall design and propose acceptable methods, processes, or report formats and propose use of an industry standard, or minimally, a recommended standard by published evidence.

Task 1: REPORTING

REPORTING REQUIREMENTS

The Contractor shall participate in meetings/briefings and provide documented summaries. The Contractor shall participate in joint reviews, track action items, schedule resources, and summarize technical and/or administrative problems encountered with recommendations for remediation. Activities in this area are estimated to be approximately 30 meetings per month. Contractors attending meetings as members of project teams or in preparation for studies shall be actively engaged in the meetings, offering expert advice, suggestions, and recommendations on patient safety issues as appropriate. The Contractor shall provide Monthly Status Reports for all task areas identified in the task sections below. All other deliverables are to be provided as standalone deliverables. All reports and documentation deliverables submitted to VA shall be formatted in Microsoft Office application, Adobe Portable Document Format (.PDF) or other as agreed to by VA. If an issue arises in the Monthly report, the Contractor shall meet with the VA PM and/or COR to discuss the issues and potential resolutions

Deliverables 5.1.1:

A. Monthly Status Reports

TASK 2: PATIENT SAFETY PROGRAM SUPPORT SERVICES

PATIENT SAFETY METHOD DEVELOPMENT

The government will identify and the contractor shall develop patient safety methods, metrics and tools for the development and implementation of VA HIT systems. The contractor will prepare a Deliverable Expectation Document (DED, sample provided). Methods include a brief description, appropriate uses, level of effort, timeframe, dependencies, and required level of skill. Tools can be templates, checklists, and other written guidance. The Contractor shall implement and maintain the tools and metrics. The Government anticipates up to 6 methods, metrics, and tool developments each period of performance. The Contractor developed patient safety methods; metrics and tools developed within this task shall be applied to the HIT Systems Evaluations and continually refined to ensure the process is as efficient as possible.

Deliverable 5.2.1:

A. Patient Safety Methods, Metric and Tools delivered in Microsoft Office or MS Share Point medium. Up to 6, due upon completion

PATIENT SAFETY TRACKING (OPTIONAL - base year will be exercised) Base Year Only and optional task in OYs: The Contractor shall support maintenance and changes of the JIRA safety issue tracking system. This will require the Contractor to facilitate all work between IPS staff and the Jira Issue Tracking System developer to ensure a comprehensive system. Connected Health currently administers the Jira Issue Tracking System. The Contractor shall work with the administrator and IPS to identify and modify data elements necessitating any modifications. The Contractor shall work with the administrator and IPS to create new data elements where applicable.

Deliverable 5.2.2:

A. Monthly report of requests for changes and modifications in progress and/or completed.

Task 3: Project Tracking The Government will provide the hosting framework (i.e SharePoint, JIRA or other) for project tracking. Contractor shall provide a comprehensive Project Space, to include ongoing support, maintenance and agreed upon changes. This will require the Contractor to work with the government’s designated staff to ensure a comprehensive system is in place. The Contractor shall create and implement input forms for the IPS data elements. The Contractor shall test the changes with applicable data entry and workflow process as provided by the government and provide a test report. The Contractor shall create and implement data views and reports within the Project Space as determined by the government.

Deliverable 5.3:

A. Monthly report of requests for changes and modifications which are in progress and/or completed.

B. OPTIONAL–probably Base Year only - The Contractor shall provide training materials to IPS staff on the use of the Project space. Training materials may include videos and printable formats.

TASK 4: HIT SAFETY ARTIFACT development The government will identify and the Contractor shall develop HIT safety artifacts in the form of guidelines, best practices, safety alerts, best practice briefs, guidance documents, operating procedures, checklist, instructions, or other agreed upon artifact. The Contractor shall develop up to 6 safety artifacts over the course of each period of performance. The contractor will prepare a Deliverable Expectation Document (sample provided). Artifacts will be developed within MS Office Suite of tools and/or SharePoint suite of tools. The government will provide necessary access to the designated SharePoint server.

Deliverable 5.4:

A. HIT Safety Artifacts. 6, due upon completion

Task 5: DATA ANALYSIS AND SYNTHESIS REPORTING The government will identify and the Contractor shall be required to perform data analysis and synthesis and provide four (4) quarterly reports and one (1) Annual report for the program’s activities.

Deliverable 5.5:

A. Summary report of program’s activities within 30 days of end of each quarter for a total of 4 quarters B. Annual report of prior fiscal year to be delivered by end of quarter 1. (12/31)

Task 6: HIT SAFETY ASSESSMENT SUPPORT SERVICES The Contractor shall evaluate Health Information Technology (HIT) products/processes identified by the Government, along with the interoperability between them and develop inspection processes and tools for evaluation by field and program offices using industry standards and best practices; assess workflow processes for changes in the information management and associated information technology systems within the healthcare environment. (For example – EHR flight simulator) The Contractor shall provide support services for HIT patient safety assessments (e.g. Computerized Provider Order Entry (CPOE) medication ordering, Clinical Decision Support functional assessment, other CPOE or clinical ancillary functional assessment) estimated at four per period of performance. The contractor will prepare a Deliverable Expectation Document (DED) (sample provided).

Deliverable 5.6:

A. HIT Patient Safety Assessment Artifact(s) - Based on outcome of the DED, the deliverable may be a set of artifacts created with MS Office Suite and/ SharePoint suite of tools. 4 sets, Due upon completion of artifact(s).

Optional Tasks - PATIENT SAFETY PROGRAM SUPPORT SERVICES

OPTIONAL - PATIENT SAFETY METHOD DEVELOPMENT

The government will identify and the contractor shall develop patient safety methods, metrics and tools for the development and implementation of VA HIT systems. The contractor will prepare a Deliverable Expectation Document (sample provided). Methods include a brief description, appropriate uses, level of effort, timeframe, dependencies, and required level of skill. Tools can be templates, checklists, and other written guidance. The Contractor shall implement and maintain the tools and metrics. The Government anticipates up to 2 method, metric, and tool developments each period of performance. The Contractor developed patient safety methods; metrics and tools developed within this task shall be applied to the HIT Systems Evaluations and continually refined to ensure the process is as efficient as possible.

Deliverable 5.7.1:

A. Patient Safety Methods, Metric and Tools delivered in Microsoft Office or MS SharePoint. 2 each, due upon completion

OPTIONAL - PATIENT SAFETY METHOD DEVELOPMENT

The government will identify and the contractor shall develop patient safety methods, metrics and tools for the development and implementation of VA HIT systems. The contractor will prepare a Deliverable Expectation Document (sample provided). Methods include a brief description, appropriate uses, level of effort, timeframe, dependencies, and required level of skill. Tools can be templates, checklists, and other written guidance. The Contractor shall implement and maintain the tools and metrics. The Government anticipates up to 2 method, metric, and tool developments each period of performance. The Contractor developed patient safety methods; metrics and tools developed within this task shall be applied to the HIT Systems Evaluations and continually refined to ensure the process is as efficient as possible.

Deliverable 5.7.2:

A. Patient Safety Methods, Metric and Tools delivered in Microsoft Office or MS Share Point 2 each, due upon completion

OPTIONAL - PATIENT SAFETY METHOD DEVELOPMENT

The government will identify and the contractor shall develop patient safety methods, metrics and tools for the development and implementation of VA HIT systems. The contractor will prepare a Deliverable Expectation Document (sample provided). Methods include a brief description, appropriate uses, level of effort, timeframe, dependencies, and required level of skill. Tools can be templates, checklists, and other written guidance. The Contractor shall implement and maintain the tools and metrics. The Government anticipates up to 2 method, metric, and tool developments each period of performance. The Contractor developed patient safety methods; metrics and tools developed within this task shall be applied to the HIT Systems Evaluations and continually refined to ensure the process is as efficient as possible.

Deliverable 5.7.3:

A. Patient Safety Methods, Metric and Tools delivered in Microsoft Office or MS Share Point. 2 each, due upon completion optional Task- HIT SAFETY ARTIFACT DEVELOPMENT

OPTIONAL - HIT SAFETY ARTIFACT DEVELOPMENT

The government shall identify and the Contractor shall develop HIT safety artifacts in the form of guidelines, best practices, safety alerts, best practice briefs, guidance documents, operating procedures, checklist, instructions, or other agreed upon artifact. The Contractor shall develop up to 4 safety artifacts over the course of each period of performance. The contractor will prepare a Deliverable Expectation Document (sample provided). Artifacts will be developed within MS Office Suite of tools and/or SharePoint suite of tools. The government will provide necessary access to designated SharePoint server.

Deliverable 5.8.1:

A. HIT Safety Artifacts. 4, Due upon completion.

OPTIONAL - HIT SAFETY ARTIFACT DEVELOPMENT

The government shall identify and the Contractor shall develop HIT safety artifacts in the form of guidelines, best practices, safety alerts, best practice briefs, guidance documents, operating procedures, checklist, instructions, or other agreed upon artifact. The Contractor shall develop up to 4 safety artifacts over the course of each period of performance. The contractor will prepare a Deliverable Expectation Document (sample provided). Artifacts will be developed within MS Office Suite of tools and/or SharePoint suite of tools. The government will provide necessary access to designated SharePoint server.

Deliverable 5.8.2:

A. HIT Safety Artifacts. 4, Due upon completion

GENERAL REQUIREMENTS

MINIMUM QUALIFICATIONS

The following minimum standards shall apply for all personnel performing under this contract and shall be maintained throughout the life of the contract.

A. Program Manager

Functional Responsibilities:

Performs analytical tasks designed to collect and analyze information. Develops briefings, presentations, training and reports. Possesses experience in specialty areas as required by the contract; works independently and can manage the work effort of other team members.

Minimum Experience/Education:

Proposed staff should possess at least a 2-year degree in healthcare related field, and minimum 2 years related experience.

B. Functional Analyst

Functional Responsibilities:

Supports other project team members. Performs analytical tasks designed to collect and analyze information. Has experience in specialty areas as required by the contract and works effectively and efficiently with limited supervision.

Minimum Experience/Education:

Proposed staff should possess a Master’s degree in the healthcare related field, or minimum 2-year experience with Health Informatics.

C. Data Analyst

Functional Responsibilities:

Supports other project team members. Performs analytical tasks designed to collect and analyze information. Has experience in specialty areas as required by the contract and works effectively and efficiently with limited supervision.

Minimum Experience/Education:

Proposed staff should possess a 2-year degree in the healthcare related field, or minimum 1-year experience with Health Informatics.

ENTERPRISE AND IT FRAMEWORK

ONE-VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (One-VA TRM). One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. One-VA TRM includes the Standards Profile and Product List that collectively serves as a VA technology roadmap. Architecture, Strategy, and Design (ASD) has overall responsibility for the One-VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://cio.gov/wp-content/uploads/downloads/2012/09/Transition-to-IPv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-technical-basis-next-generation-internet), the Technical Infrastructure for USGv6 Adoption (http://www-x.antd.nist.gov/usgv6/index.html), and the NIST SP 800 series applicable compliance (http://csrc.nist.gov/publications/PubsSPs.html) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at: https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 7 (64bit), Internet Explorer 11 and Microsoft Office 2010. In preparation for the future VA standard configuration update, end user solutions shall also be compatible with Office 365 ProPlus and Windows 10. However, Office 365 ProPlus and Windows 10 are not the VA standard yet and are currently approved for limited use during their rollout, we are in-process of this rollout and making them the standard by OI&T. Upon the release approval of Office 365 ProPlus and Windows 10 individually as the VA standard, Office 365 ProPlus and Windows 10 will supersede Office 2010 and Windows 7 respectively. Applications delivered to the VA and intended to be deployed to Windows 7 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by the VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP)

The Contractor shall support VA efforts IAW the Veteran Focused Integration Process (VIP). VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise. The VIP Guide can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371. The VIP framework creates an environment delivering more frequent releases through a deeper application of Agile practices. In parallel with a single integrated release process, VIP will increase cross-organizational and business stakeholder engagement, provide greater visibility into projects, increase Agile adoption and institute a predictive delivery cadence. VIP is now the single authoritative process that IT projects must follow to ensure development and delivery of IT products

PROCESS ASSETT LIBRARY (PAL)

The Contractor shall utilize PAL, the OI&T-wide process management tool that assists in the execution of an IT project (including adherence to VIP standards). PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards or guides to assist project teams in facilitating their VIP compliant work.

SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable:

A. Contractor Staff Roster

METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products.

Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

FACILITY/RESOURCE PROVISIONS

The Government will provide office space, telephone service and system access when authorized contract staff work at a Government location as required in order to accomplish the Tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use…