ATTACHMENT B - BA HAM TO-1 PWS_v0.03.docx

BA Health Architecture Modernization Task Order #1 PWS

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS (VA)

VETERANS HEALTH ADMINISTRATION (VHA)

OFFICE OF HEALTH INFORMATICS (OHI)

STRATEGIC INVESTMENT MANAGEMENT (SIM)

BUSINESS ARCHITECTURE SERVICE (BA)

BA HEALTH ARCHITECTURE MODERNIZATION

Task Order #1 Date: 09/29/2021 PWS Version Number: 0.03

Table of Contents

BACKGROUND

See Business Architecture (BA) Health Architecture Modernization (HAM) Single-award Indefinite Delivery Indefinite Quantity (IDIQ) Performance Work Statement (PWS) Section 1.0 – Background.

Applicable Documents See Business Architecture (BA) Health Architecture Modernization (HAM) Single-award Indefinite Delivery Indefinite Quantity (IDIQ) Performance Work Statement (PWS) Section 2.0 – Applicable Documents.

SCOPE OF WORK

The functional component areas the contractor shall support in this Task Order (TO) are: Integration and Reference Architecture, Process and Value Architecture, and Information and Knowledge Architecture. This includes both professional and technical health information services in support of BA and VA/VHA program offices. The types of services represented under this TO PWS are:

1. Business process modeling and Process and Value architecture services.

1. Business information modeling and Information and Knowledge architecture services.

1. Integration and Reference architecture services.

1. Internal and external information exchange (e.g., analysis, issues, updates, trends).

1. Subject matter expert advice for the functional component areas.

1. Decision support services for collaboration efforts.

1. Participation on working groups or teams.

1. Interoperability advisory services (e.g., Electronic Health Record Modernization (EHRM), Financial Management Business Transformation (FMBT), Supply Chain/VALOR, Defense Health Agency (DHA)/VHA collaboration work, VA/VHA Modernization, Federal Electronic Health Record Modernization (FEHRM), and other VA/DoD interoperability work efforts)

1. Health Care Delivery analysis and design.

1. Independent assessments of VHA and VA business products and services for gaps or deficiencies.

1. Development and delivery of executive briefings and presentations to senior management on VHA emerging health technology change management, and other architectural artifacts.

1. Internal and external collaboration planning.

1. Services in support of VHA’s BA lifecycle.

Additionally, the architecture domain areas that shall be supported by this TO are categorized and depicted in the following list and figures:

The VHA Capability and Service Architecture domains are:

1. Care Delivery Capabilities:

· Clinical Care Capabilities – include Dentistry, Geriatrics / Extended Care, Imaging, Laboratory / Pathology, Medicine Services, Mental Health, Primary Care (Women’s Health, Primary Care General, and Primary Care Other), Radiation Oncology, Rehabilitation, Specialty (Anesthesia, Ophthalmology, and Other Specialty), and Surgery.

· Clinical Enabling Capabilities – include Health Administration, (Capacity Management, Billing & Coding, In Patient (incl Admission, Discharge, Transfer (ADT)), Medical Records, Privacy & FOIA, and Other Health Administration), Health Delivery Support, (Pharmacy, Library, Research, Voluntary, Education, and Other Health Delivery Support), Quality Systems, (Utilization Management, Credentialing & Privileges, and Other Quality Systems), and Operational Support, (Fiscal (excl. claims & billing), (Facility) Engineering, Environmental Management, Logistics, Police, Canteen Services, Human Resources, and Other Operational Support).

2. Care Coverage Capabilities – include Eligibility & Enrollment, Disability Evaluation, (Care) Approvals, Claims Processing, Provider Network Management, and Other Care Coverage.

3. Patient Management Capabilities – include Patient Registration, Patient Education, Patient Preferences, and Other Patient Management.

4. Health Business Services:

· Common Health Care Workflows – include Scheduling, Consults & Referrals Management, Orders, Care Guidelines/Educational Materials, Adverse Reactions, Patient Reminders, Care Coordination, Medication Administration, Care Plan Management, Observations, and ADT.

· Common Health Care Specific Common Service Components – include Clinical Context Management, Medical Reference Library, Patient Location, Clinical Decisions Support (incl. Reminders), Registries, Positive Identification, Consents, and Population Health Assessments.

5. Health IT Services:

· Virtual Veteran Record – includes Documents & Images, Documentation, Terminology, Patient Identity, External Clinical Record Integration, Patient Entered Data Integration & Management, Record Access Control, Radiology Images, and Demographics.

· Health Care IT Infrastructure – includes Single Sign On, Core GUI, and Medical Device Integration.

· Enterprise IT Infrastructure – includes Data Analytics, Inventory, Workflow Engine, Secure Messaging, Security Services, Services Broker, Other Infrastructure Services, Reporting System, Finance / Accounting System, and Barcoding & Radio Frequency Identification (RFID) Technology.

VHA Capability and Service Architecture

Figure 1: VHA Capability and Service Architecture In order to strengthen and improve OHI, SIM and BA’s ability to deliver quality health enterprise architecture information and services for leadership, clinicians and other health care professionals, the contractor shall employ VHA’s Capability and Service Architecture constructs and principles, and shall meet and/or conform to best business and industry practices, e.g., Federal Enterprise Architecture (FEA), federal segment architecture methodologies, DoD Architecture Framework (DoDAF), Health Level 7 (HL7), Services-Aware Interoperability Framework (SAIF), Office of National Coordinator (ONC), Federal Health Architecture (FHA), Malcolm Baldrige, Capability Maturity Model Implementation (CMMI), IT Infrastructure Library (ITIL), Project Management Institute’s (PMI™) Project Management Body of Knowledge (PMBOK), and International Institute of Business Analysis (IIBA) Business Analysis Body of Knowledge (BABOK) Guide.

Please Note: The VA has ownership of all deliverables and work products involved in this effort.

Figure 2: VHA Transition Management Framework

· National Standard Baseline models exist, leveraging legacy IT and best practices in industry and across VHA.

· Sites migrate from their disparate processes, as much as possible, to standard baseline.

· National Standard Future State models exist informed by OEHRM/Cerner Workflows, field experience and actual practices using Cerner.

· As OEHRM/Cerner rolls out transition it is from a more uniform starting point (the baseline) leading to more repeatable, predictable, results and outcomes.

· Models are a part of the Change Management Framework that informs and enables:

· Training

· Staffing

· Expectation Management

· Partner Integration

· Validation

CHANGES TO THE PWS

See Business Architecture (BA) Health Architecture Modernization (HAM) Single-award Indefinite Delivery Indefinite Quantity (IDIQ) Performance Work Statement (PWS) Section 3.1 – Changes to the PWS.

PERFORMANCE DETAILS

The following describes the performance details associated with this TO.

PERFORMANCE PERIOD

This period of performance for this TO shall not exceed one base year plus four option years.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities and/or Government- provided facilities. Government provided facilities include Washington, DC, and Tampa Bay/St. Petersburg, FL, areas.

TRAVEL

The Contractor shall attend meetings in Washington, D.C. St. Petersburg, and/or other VA facilities. Local travel within a 50-mile radius from the Contractor’s facility is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized for reimbursement on a case-by-case basis and must be pre-approved by the Contracting Officer’s Representative (COR).

Travel costs will be included in the TO award as a separate, cost-reimbursable, “not to exceed” (NTE) line item. Travel will be requested, approved, and reimbursed in accordance with the TO.

The Government estimates the following travel for the period of performance:

SPECIFIC TASKS AND DELIVERABLES

This PWS provides specific requirements (deliverables). Functional Component Areas are described below. Requirements shall fall within the areas described in Sections 5.1 through 5.3. This TO encompasses more than one functional component area. Functional component area requirements are not mutually exclusive and may apply across multiple functional component areas.

The Functional Component Areas are:

1. Integration and Reference Architecture.

2. Process and Value Architecture.

3. Information and Knowledge Architecture.

INTEGRATION AND REFERENCE ARCHITECTURE SUPPORT SERVICES

Integration and Reference (IR) coordinates the integration of business architecture concepts and depicts the components of VHA’s business and their relationships to each other. IR develops and maintains multiple architecture perspectives to include the relationships between VHA functions, capabilities, services, and other relevant architectural concepts. The VHA Health Enterprise Architecture supports the categorization and planning of the underlying business processes and information elements that are used to deliver healthcare and health-business capabilities. This information helps ensure that VHA Modernization plans are directly linked to strategic goals. IR maintains the VHA Business Architecture Repository (BAR), a repository of business architecture content and their associations. The Contractor shall provide Integration and Reference architecture support services for healthcare clinical and administrative areas that include assisting BA with architecturally defining VHA capabilities, planning, scope coordination and management, reporting, ad-hoc reference architecture analysis and continued maturity of all Integration and Reference architecture concepts. The Contractor shall support completion of work efforts, leveraging technical writer skills, which involve diverse internal and external stakeholder engagements including end users and subject matter experts, resulting in a common understanding of referential alignments and reporting. The healthcare related work efforts include VA Secretary and Under Secretary for Health identified and prioritized efforts. Examples would include Business Transformation and Risk Identification Management (BTRIM) initiatives that focus on Electronic Health Record Modernization (EHRM), Financial Management Business Transformation (FMBT), and Supply Chain/VA Logistics Refresh (VALOR) modernization efforts, as well as Defense Health Agency (DHA)/VHA collaboration work.

Analyze and Inform VHA Information Technology Needs. The Contractor shall support the business customer in identifying and understanding the business needs, identifying gaps, overlaps, and/or redundancies (IT and non-IT) to enhance the business understanding and accomplish business goals, and preparing the needs for VHA Governance (when/where appropriate). Work is based upon multi-year planning and prioritization activities organized and led by the Architecture Requirements and Investment Working Group (ARIWG).

Planning and Scope Coordination. In conjunction with government leadership, the Contractor shall assist business customers with efforts to define and validate work effort scope, structure and schedule, identify and coordinate Stakeholders (Subject Matter Experts (SMEs), Business Owners and other supporting staff) including supporting the establishment of roles and responsibilities, review existing documentation (environmental scan and other relevant information), and facilitation of work effort kick-off meeting with identified Stakeholders to discuss all of the above.

VHA Integration Requirements and Reference Architecture. The Contractor shall assist in BA efforts to elicit, refine, and document integration and reference support activities associated with VHA’s Requirements repository to inform architecture related reporting, analysis, and project planning. Support activities include modeling and architecture requirements, architecture content elicitation utilizing Agile Methodologies, using VA approved Collaborative Lifecycle Management tools (currently primary tools are Microsoft Visio, Microsoft Power BI, and SQL Server).

The level of effort of the Contractor shall be limited to identified domains. Domains are understood through the VHA Capability and Service Architecture (see figure 1: VHA Capability and Service Architecture above). Capabilities offered by VHA form the architectural basis to help organize scope, requirements and architecture and are a perspective into the Health Business Architecture. Services are the mechanisms by which VHA achieves its Capabilities and form a Perspective/view into the Health Business Architecture.

Leveraging all relevant historical documentation as part of performing all tasks within this PWS, the Contractor shall provide support services that include Coordination of the delivery of Integration and Reference architecture work efforts, Delivery of Integration and Reference architecture support, and Delivery of Integration and Reference architecture services to ensure appropriate operational and architectural integration and value.

Coordination of the delivery of Integration and Reference architecture work efforts. To include facilitation, business reference modeling (e.g., mappings/alignments) and re-engineering, architecture requirements capture, and approved scoping documentation and engagement strategies for healthcare clinical and administrative areas.

Delivery of Integration and Reference architecture support services. For the VHA healthcare clinical and administrative setting including business descriptive and definition modeling, analysis, mappings/alignments, matrices, functional decomposition, maturation of the business reference models, and maintenance of a comprehensive list and database of Integration and Reference artifacts/primitives and their alignments. Continue to improve database outliers and mapping updates.

Delivery of Integration and Reference architecture services to ensure successful integration. To ensure successful integration of architectural artifacts that yield “value add” architecture content, using current methodologies, industry best practices and innovative insight.

Domain/Work Effort Monthly Reports (DMR): This report shall include, as appropriate: models and matrices, summary updates, status/progress updates, Integrated Master Schedule (IMS) updates, and meeting minutes.

Reference Repository Packaging:

This report shall include final work effort packaging. Included in this report is the Business Architecture Repository (BAR) change documentation, updated/current VHA Capability and Service Architecture model, updated/current Business Functions), and a complete inventory of all changes and updates with version control. All documentation shall be in a format that is consumable by business customers using Microsoft Office, as well as published and integrated in the BA tooling repositories in order to be consumable by stakeholders. (quarterly) (4 comprehensive packaging updates) Integration Analysis Packaging and BA Logical Information Model Publication:

This report shall include updates and publications of the VHA Capability and Service Architecture reference model and publication of VHA-BA wide logical information model, to include outcomes/impacts related to BA’s Physical Meta-Model. All key architecture concepts and relationships shall be addressed. This documentation is uploaded into and maintained within VA-approved tooling (SQL Server, Visio, and Cameo – as appropriate). All documentation shall be in a format that is consumable by business customers using Microsoft Office, as well as published and integrated in the BA tooling repositories in order to be consumable by stakeholders. (semi-annually) (2 comprehensive packaging/publication updates) Quarterly Work Activity Status Briefs:

These quarterly PowerPoint presentations shall review the completed and upcoming work efforts of the Integration and Reference architecture unit with BA team and stakeholders. (quarterly) (4 comprehensive Status Briefs) Consolidated Unit Monthly Report:

The contractor shall produce and submit a consolidated monthly report describing progress and activities. This report shall include written meeting minutes, summarizing meetings attended and minutes/notes captured, tooling system status reports, integration activity updates, and any other operational updates relevant to integration and reference activities. Likewise, the contractor shall include updates depicting all referential objects and mappings “in process” and all objects/mappings that have been completed and integrated within the architecture Framework depicted in Figure 2: VHA Transition Management Framework. Additionally, the contractor shall include all pending integration activities with estimated completion dates. All information shall be architecturally aligned by Capabilities and Services as depicted in Figure 1: VHA Capability and Service Architecture. These updates are a direct result and outcome of customer and stakeholder engagements and should reflect a holistic intent to manage VHA enterprise architecture objectives as depicted in Figure 2: VHA Transition Management Framework Necessary updates to the BA Logical Information Model and Reference User Guide, and Guiding Principles shall be included. (Monthly) (12 comprehensive reports)

PROCESS AND VALUE ARCHITECTURE SUPPORT SERVICES

Business Process and Value (BPV) provides business process modeling support and guidance to capture and communicate VHA business process needs through process analysis, improvement, and reengineering. BPV documents and analyzes the current state and future state by capturing the existing structure, resources, processes, and improvement opportunities. BPV works with business owners, subject matter experts (SMEs), and other stakeholders to elicit process needs, and collaborates with partners, such as Requirements Development and Management (RDM), on Information Technology (IT) work efforts. The Contractor shall provide support services that shall include Coordination of the delivery of Process and Value architecture work efforts and Delivery of Process and Value support services.

Coordination of the delivery of Process and Value architecture work efforts. For healthcare clinical and administrative areas, to include work effort scoping and engagement strategies, modeling session facilitation, re-engineering of business process modeling utilizing Business Process Model and Notation (BPMN), architecture requirements capture and integration within the VA-approved tooling. Currently, Microsoft Visio is the tool provided by the Government.

Delivery of Process and Value architecture support services. In accordance with established BA Modeling requirements. These work efforts involve the development of, and ongoing integration of VA Enterprise and VA end-to-end (E2E) process models and business requirements that reflect the current state operating environment, the development of VHA current state workflows for targeted activities within E2E process models, which are extensions of E2E process models (sub-process models) that identify additional details regarding roles, systems, applications, information, and data utilized for select activities within specific E2E process models, and the development of Site Specific E2E’s, as well as development of Joint VA and DOD E2E’s. Work efforts involve multiple inter-related business processes, multiple levels of decomposition, and diverse internal and external stakeholders, resulting in common process understanding. These work efforts also include vendor architects teaming with requirements business analysts to ensure comprehensive and integrated architecture products and value-added functional business understanding. The work efforts include Secretary and Under Secretary for Health identified and prioritized efforts. Examples would include Business Transformation and Risk Identification Management (BTRIM) initiatives that focus on Electronic Health Record Modernization (EHRM), Financial Management Business Transformation (FMBT), and Supply Chain/VA Logistics Refresh (VALOR) modernization efforts, as well as Defense Health Agency (DHA)/VHA collaboration work.

Process Domain/Work Effort Monthly Reports (PDMR):

This report shall include, as appropriate: models and matrices, summary updates, status/progress updates, Integrated Master Schedule (IMS) updates, and meeting minutes. This report shall also include applicable completed and final work effort packaging for VA Enterprise E2E process models, Site Specific E2E’s, Joint E2E’s (by capability), and other Process and Value support efforts in the form of Process Model Summary Reports (PMSR) and/or site, VISN and Program Office Process Model Release Packages. All documentation shall be in a format that is consumable by business customers using Microsoft Office, as well as published and integrated in the VA-approved tooling repositories to be consumable by all stakeholders. (Monthly) (12 comprehensive PDMRs) Quarterly Work Activity Status Briefs:

These quarterly PowerPoint presentations shall review the completed, ongoing, and upcoming work efforts of the Process and Value architecture activities with BA team and stakeholders. (Quarterly) (4 comprehensive Status Briefs) Operational Model Integration Updates:

The contractor shall provide status updates depicting all process models “in process” and all models that have been completed and integrated within the architecture framework. Likewise, the contractor shall include all pending integration activities with estimated completion dates. All information shall be architecturally aligned by Capabilities and Services as depicted in Figure 1: VHA Capability and Service Architecture. These updates are a direct result and outcome of customer and stakeholder engagements and should reflect a holistic intent to manage VHA enterprise architecture objectives as depicted in Figure 2: VHA Transition Management Framework. Where appropriate, all work and discoveries shall include updates for the BPV Guidelines and Standards document. All documentation shall be in a format that is consumable by business customers using Microsoft Office, as well as published and integrated in the VA-approved tooling repositories to be consumable by all stakeholders. (Monthly) (12 comprehensive tracking logs/reports)

INFORMATION AND KNOWLEDGE ARCHITECTURE SUPPORT SERVICES

Business Information and Knowledge (BIK) creates and maintains information models that logically categorize the data concepts in use within VHA operations. BIK information models provide an organizational standard for how enterprise data should be logically structured and offer an easily consumable view of related information concepts. BIK products enable senior leadership to make critical enterprise-wide information decisions that promote data stewardship, enterprise consistency, and interoperability with external partners. The Contractor shall provide support services that shall include Coordination of the delivery of Information and Knowledge architecture work efforts and Delivery of Information and Knowledge architecture support services.

Coordination of the delivery of Information and Knowledge architecture work efforts. For healthcare clinical and administrative areas, to include work effort scoping and engagement strategies, modeling session facilitation, information modeling utilizing Unified Modeling Language (UML), architecture requirements capture and integration within the VA-approved tool. Currently, Microsoft Visio and NoMagic Cameo Enterprise Architecture are the tools provided by the Government.

Delivery of Information and Knowledge support services. In accordance with established BA Modeling requirements. These work efforts involve development of information models for the VA end-to-end (E2E) process models and business requirements that reflect the current state operating environment, development of information models for VHA current state workflows for targeted activities within E2E process models, which are extensions of E2E process models (sub-process models) that identify additional details regarding roles, systems, applications, information, and data utilized for select activities within specific E2E process models, development of information models for Site Specific E2E’s, as well as development of information models for Joint VA and DoD E2E’s. Work efforts involve multiple inter-related business data flows, multiple levels of decomposition, and diverse internal and external stakeholders, resulting in common data/information understanding. These work efforts also include vendor architects teaming with requirements business analysts to ensure comprehensive and integrated architecture products and value-added functional business understanding. The work efforts include Secretary and Under Secretary for Health identified and prioritized efforts. Examples would include Business Transformation and Risk Identification Management initiatives that focus on Electronic Health Record Modernization (EHRM), Financial Management Business Transformation (FMBT), and Supply Chain/VA Logistics Refresh (VALOR) efforts, as well as Defense Health Agency (DHA)/VHA collaboration work.

Information Domain/Work Effort Monthly Reports (IDMR):

This report shall include, as appropriate: models and matrices, summary updates, status/progress updates, Integrated Master Schedule (IMS) updates, and meeting minutes. This report shall also include applicable completed and final work effort packaging for Information and Knowledge support efforts in the form of Information Model Summary Reports (IMSR) and/or site, VISN and Program Office Information Model Release Packages. All documentation shall be in a format that is consumable by business customers using Microsoft Office, as well as published and integrated in the VA-approved tooling repositories in order to be consumable. (for more information refer to the BIK Guiding Principles document). (Monthly) (12 comprehensive IDMRs) Quarterly Work Activity Status Briefs:

These quarterly PowerPoint presentations shall review the completed, ongoing, and upcoming work efforts of the Information and Knowledge architecture activities with BA team and stakeholders. (Quarterly) (4 comprehensive Status Briefs) Operational Model Integration Updates:

The contractor shall provide status updates depicting all information objects and models “in process” and all objects/models that have been completed and integrated within the architecture framework. Likewise, the contractor shall include all pending integration activities with estimated completion dates. All information shall be architecturally aligned by Capabilities and Services as depicted in Figure 1: VHA Capability and Service Architecture. These updates are a direct result and outcome of customer and stakeholder engagements and should reflect a holistic intent to manage VHA enterprise architecture objectives as depicted in Figure 2: VHA Transition Management Framework. Where appropriate, all work and discoveries shall include updates for the BIK Guidelines and Standards document. All documentation shall be in a format that is consumable by business customers using Microsoft Office, as well as published and integrated in the VA-approved tooling repositories to be consumable by all stakeholders. (Monthly) (12 comprehensive tracking logs/reports)

GENERAL REQUIREMENTS

Quality Control (QC): The Contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QC program is the means by which he assures himself his work complies with the requirements of the individual TO. As a minimum, the Contractor shall develop QC procedures addressing the areas identified in the “Performance Metrics Table” defined in the TO. After acceptance of the QC plan, the Contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system.

Quality Assurance (QA): The Government shall evaluate the Contractor’s performance under this TO in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government shall do to ensure the Contractor has performed in accordance with the performance standards. It defines how the performance standards shall be applied, the frequency of surveillance, and the minimum acceptable defect rates. Quality standards and the QASP are tailored for each project and shall be outlined in the PWS for that TO. The table below provides a sample of standards and descriptions the Government may use to evaluate TOs.

PERFORMANCE METRICS

The Government will utilize a Quality Assurance Surveillance Plan (QASP) to ensure the quality levels of deliverables. See Attachment C.

ENTERPRISE AND IT FRAMEWORK

See Business Architecture (BA) Health Architecture Modernization (HAM) Single-award Indefinite Delivery Indefinite Quantity (IDIQ) Performance Work Statement (PWS) Section 6.2 – Enterprise and IT Framework.

SECURITY AND PRIVACY REQUIREMENTS

See Business Architecture (BA) Health Architecture Modernization (HAM) Single-award Indefinite Delivery Indefinite Quantity (IDIQ) Performance Work Statement (PWS) Section 6.3 – Security and Privacy Requirements.

POSITION/TASK RISK DESIGNATION LEVEL(S)

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the TO are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

See Business Architecture (BA) Health Architecture Modernization (HAM) Single-award Indefinite Delivery Indefinite Quantity (IDIQ) Performance Work Statement (PWS) Section 6.4 –Contractor Personnel Security Requirements.

METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include files compatible with the following applications: MS Word 2010, MS Excel/2010, MS PowerPoint 2010, MS Project 2010, MS Access 2010, MS Visio 2010, and Adobe Portable Document Format (PDF), or subsequent versions as applicable.

FACILITY/RESOURCE PROVISIONS

The Government will provide office space, telephone service and system access when authorized contract staff work at a Government location as required to accomplish the Tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All the security controls required for Government furnished equipment (GFE) must be utilized in approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use. CAG authorized users shall not be permitted to copy, print, or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non-North Atlantic Treaty Organization (NATO) countries. The exception to this is countries where VA has approved operations established (e.g., Philippines and South Korea). Exceptions are determined by the COR in coordination with the Information Security Officer (ISO) and Privacy Officer (PO).

This remote access may provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, ProPath, Primavera, and Remedy, including appropriate seat management and user licenses, depending upon the level of access granted. The Contractor shall utilize government-provided software development and test accounts, document, and requirements repositories, etc. as required for the development, storage, maintenance, and delivery of products within the scope of this effort. The Contractor shall not transmit, store, or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

GOVERNMENT FURNISHED PROPERTY

The Government has determined that remote access solutions involving Citrix Access Gateway (CAG) have proven to be an unsatisfactory access method to complete the tasks on this specific contract. The Government also understands that GFE is limited to Contractors requiring direct access to the network to: access development environments; install, configure and run TRM-approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner, etc.); upload/download/ manipulate code, run scripts, apply patches, etc.; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

Based on the Government assessment of remote access solutions and the requirements of this contract, the Government estimates that the following GFE will be required by this contract:

1. Approximately thirteen (13) standard laptops.

1. N/A of developer-grade laptops.

1. Tooling described in BRAMP Appendix D will be provided by VA. Contractor is responsible for knowledge and experience using the listed tools.

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra PIV readers, peripheral devices, additional RAM, etc. The Contractor is responsible for providing these types of IT accessories in support of the contract as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

image1.jpeg image2.emf image3.emf image2.png image3.png