Draft PWS HICBA Encoder_7-18-2025.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Health Information Management

Health Information Coding, Billing and Auditing (HICBA):

Encoder Software Solution and Support

Date: July 17, 2025

VA-26-00001127

PWS Version Number: 1.5

HICBA: Encoder Software Solution and Support

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 KICKOFF MEETING

5.1.4 RISK MANAGEMENT

5.1.5 CONFERENCE CALLS AND MEETINGS

5.2 SOFTWARE REQUIREMENTS

5.2.1 COMPLIANCE REQUIREMENTS

5.2.2 ENCODER REQUIREMENTS

5.3 TECHNICAL SUPPORT

5.3.1 TECHNICAL AND ON CALL SUPPORT

5.3.2 SOFTWARE SUSTAINMENT SUPPORT

5.4 TRAINING

5.4.1 END USER TRAINING

5.4.2 SYSTEM ADMINISTRATOR TRAINING

5.5 TRANSITION-IN SUPPORT (Base period only)

5.6 ADDITIONAL SOFTWARE REQUIREMENTS (OPTIONAL TASK)

5.6.1 OPTIONAL TASK ONE: WEB TRAINING FOR OEM UPGRADES AND

OEM ENHANCEMENTS

5.6.2 OPTIONAL TASK TWO: TRANSITION OUT SUPPORT

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM) 28

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY AND

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Office of Health Informatics strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely, and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA, Veterans Health Administration (VHA) physicians, nurses, and health care personnel provide quality medical treatment to more than 9 million Veterans and their families per year. VHA personnel practice all medical specialties and provide medical and rehabilitative treatment of all kinds, from acute to long term care to outpatient care.

VHA’s Health Information Management (HIM) Program Office within the VHA Office of Health Informatics, Digital Health Office, is the business owner of the Health Information Coding, Billing and Auditing (HICBA) Encoder and Veterans Health Information Systems and Technology Architecture (VistA) Integration, Reporting, and Revenue (VIRR) software solutions that assist VA coding and revenue professionals in accurately and consistently coding and billing health care encounters and inpatient stays. A medical encoder is a software tool or suite that assists in the accurate and efficient coding of medical procedures and diagnosis by using a set of terminology that branches from general to more specific to classify disease and servers provided. Abstract is a coded representation of a clinical encounter or interaction between healthcare provider and patient or provider to provider interaction of care. In this PWS, the words encounter, and abstract are used interchangeably.

VHA Directive 1082(1) Patient Care Data Capture and Closeout mandates the use of an enterprise-wide encoder software solution inclusive of functions to determinate accurate medical codes representing care documented by clinical staff using the approved Health Insurance Portability and Accountability Act (HIPAA) standard code set values as required by setting for both diagnosis and procedures/services. The HICBA solution is comprised of two components which interface: the HICBA Encoder software solution and the HICBA VIRR software solution. This PWS contains requirements for the HICBA Encoder software solution.

As VHA transitions its Electronic Health Record (EHR) to the Federal EHR solution under the leadership of the Office of EHR Modernization, it is imperative that the HICBA solution continue to meet the mandates of VHA Directive 1082(1), to include the full spectrum of enterprise-wide encoder and revenue reporting and to provide for enterprise-wise utilization of a product to expedite the coding process and ensure all billable events are coded in a timely manner (with at least weekly reporting). Enterprise reporting capabilities must be seamless across the Federal EHR-implemented and VistA legacy sites.

The HICBA Encoder software assists VHA HIM in electronic code lookup, instruction notes, sequence, coding potential errors and coding references to aid in determining

HIPAA standard code set values, including Medicare Severity-Diagnosis Related Groups (MS-DRG), International Classification of Diseases (ICD) 9 and ICD 10-Clinical Modifications (CM), ICD10-Procedure Coding System (PCS), Healthcare Common PCS (HCPCS), Current Procedural Terminology (CPT), Current Dental Terminology (CDT) and All Patient Refined-Diagnosis Related Groups (APR-DRG), as appropriate for an individual care setting and alignment to official coding guidelines and coding reporting requirements outlined by HIPAA Administrative Simplification Act. The encoder is utilized to determine and sequence all diagnosis, present on admission delineated values as appropriate, procedure or service codes representing care documented in the patient’s health record and translated to coded values by HIM professionals to ensure compliance. Data from VistA utilized in care setting and patient specific demographics are utilized by the encoder to ensure active and valid code versions are the only values selectable by care setting to represent the specific data elements required for all healthcare transactions as determined by the coder from the encoder and is stored in a real-time bidirectional interface with other HICBA VIRR product vendor to facilitate storage and use by VHA in the EHR system.

In November 2018, VA issued the Cloud First Policy mandating that all new and existing IT solutions be assessed to determine suitability to be offered as an enterprise cloud computing service. The VA Enterprise Cloud (VAEC) was established by the Enterprise Cloud Solutions Office (ECSO) in 2017, to host cloud computing solutions.

The HICBA Encoder Solution shall be migrated to and/or hosted in the VAEC.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this PWS, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,”

September 3, 2024 https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 https://www.idmanagement.gov/arch/#:%7E:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25,

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

65. C.F.R Title 15 Part 7, “Securing the Information and Communications

Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's

Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and

Remediation Capabilities Related to Cybersecurity Incidents,” August 27,

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems

Vulnerability Remediation Requirements for Internet-Accessible Systems |

CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014

79. VHA Directive 1082(1), “Patient Care Data Capture and Closeout”, March 9, 2023, Amended December 11, 2023

80. VA Enterprise Cloud Technical Reference Guide, Version 2.0 November

3.0 SCOPE OF WORK

The Contractor shall provide all resources necessary to accomplish the tasks and deliverables described within this PWS to include project management, software requirements, technical support, training, transition-in support, and optional tasks, if exercised, for Web based training for upgrades and transition out support.

VHA currently consists of 130 medical centers and 7 Consolidated Patient Account Centers (CPAC) locations in all 50 states and Puerto Rico. Coding of all inpatient encounters, billable and other specified outpatient encounters such as Veterans Equitable Resource Allocation (VERA), Clinical Documentation Integrity (CDI), etc., and all surgery encounters must be supported by the encoder product for the medical services provided at each of these facilities.

The Contractor shall provide a Commercial-Off-The-Shelf (COTS) encoder solution with enterprise level software distribution to all legacy VistA sites. The Contractor shall provide the HICBA Encoder software solution to include updates to the application, compliance with HIPAA standard code sets and versions and healthcare setting appropriate for all recording and reporting of coded data transactions representing HIM professional determination of codes and application of official coding guidelines needed for recording and storage, e.g. MS-DRG, APR-DRG (OT4), ICD, HealthCare Common Procedure Codes which includes CPT and CDT, etc., for monitoring and management of coding activities and references, and technical support. The software must include references and resources utilized for HIM staff in Coding and CDI (OT3) to determine appropriate coding instructions and guidance, training, and real time bi-directional data interface with HICBA VIRR.

https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

This solution shall be hosted in the VAEC environment and be fully functional no later than 12/18/2025. In the event that a VAEC cloud service provider (CSP) has not yet been selected by VA, the Contractor shall recommend a CSP for the solution.

The Contractor shall not be responsible for providing or acquiring cloud capacity or server hosting infrastructure for this contract. VA will furnish VAEC capacity as GFE.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award with 4 12-month option periods and 4 optional tasks to be exercised at the Government’s discretion. The overall PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government does not anticipate travel under this effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

The Contractor shall designate a Contractor Project Manager (PM) as the main point of contact (POC) between the VA Program Manager (PM) and Contractor organization on this PWS effort. The PM shall also oversee and manage the schedule, and all tasks associated with this PWS. The Contractor shall collaborate with the VA Enterprise Architecture (EA) team and other VA organizations to develop and maintain deliverables, and to perform the tasks specified herein.

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

The CPMP shall include subsidiary sections which further detail the approach to be used for each aspect of the PWS. The CPMP shall include:

A. Staffing Assignment Worksheet: The Contractor shall include a Staffing

Assignment Worksheet listing all Contractor personnel assigned to this project, their contact information, and their role. If Contractor staff require background investigations, PIV Badges, and access to the VA email system, the Contractor shall include these requirements in the Staffing Assignment Worksheet.

Additional information will be required to comply with the access requests.

B. Develop and maintain a Project Management Plan (PMP) that describes the technical approach, organizational resources, and management controls to be employed to meet the schedule and performance requirements defined in this PWS. The PMP shall also address risk management and include a Risk Management and Communication Plan in accordance with section 5.1.4.

C. Integrated Master Schedule (IMS): The Contractor shall develop and maintain an IMS using a scheduling tool such as Microsoft (MS) Project or Excel. This preliminary IMS shall identify phases and milestones (such as the rollout/installation of the product, enhancement implementation (to include testing), training, etc.) and provide sufficient detail to identify deliverable dates and when the Government will be expected to attend meetings, review documentation, provide test resources and other interactions. The Contractor shall maintain the IMS by keeping it current, as dictated by program events and in coordination with the VA PM. The IMS shall be distributed in a Portable Document Format (PDF) or MS Office format

D. Implementation Plan: The Contractor shall provide an Implementation Plan for the Contractor’s approach to provide the HICBA Encoder solution at facilities across the VA enterprise. The Implementation Plan shall include a detailed timeline of events to include testing of software, access requirements to VA facilities, VA support requirements, and training.

Deliverables:

A. Contractor Project Management Plan (CPMP)

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer's Representative (COR) with Monthly Progress Reports (MPRs) in electronic form in MS Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The MPRs shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The MPR shall include project status summary, Change Request status (new, open, and closed since last report), Issue/Action Item status (new, open, and closed since last report), Risk items and their disposition, and Schedule status. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall notify the VA PM, COR, and CO, in writing, immediately if problems arise adversely impacting the performance of the tasks of this PWS.

A. MPR

5.1.3 KICKOFF MEETING

The Contractor shall plan and schedule a kickoff meeting within 10 days following contract award to outline the approach and review the schedule. The meeting shall be held via teleconference. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule. The meeting minutes shall be provided to all attendees within 1 calendar day after the meeting. The Contractor shall invite the CO, Contract Specialist, COR, Office of Strategic Sourcing Representative, and the VA PM. Kickoff meetings are not required during the option periods, if exercised.

Deliverables:

A. Kickoff Agenda B. Kickoff Meeting Minutes

5.1.4 RISK MANAGEMENT

The Contractor shall collaborate with project stakeholders to identify, prioritize, scope, bound, resource and assess course of actions related to program risks. The Contractor shall inform the VA PM of relevant deliberations and Contractor recommendations. The Contractor shall work to mitigate and resolve program risks as they are identified. The PMP shall include a Risk Management and Communication Plan.

5.1.5 CONFERENCE CALLS AND MEETINGS

The Contractor shall attend monthly conference calls with representatives from the VA HIM Program Office, COR, CPAC, Compliance and Business Integrity, and OIT at a mutually agreed upon date/time. The calls shall identify upcoming software changes, training activities, policy changes, and issues identified by the field facilities, etc. The issues may occur in software, training, business process, workload, etc. The business partners on the call shall review and implement changes that shall correct the issue. If issues are due to Contractor software, training, work process or Contractor’s Help Desk, Contractor shall present to the COR and CO resolution within seven days following identification of issue.

The Contractor shall create meeting materials (within five days prior) for all conference calls and/or meetings held with the VA PM.

Deliverable:

A. Meeting Materials

5.2 SOFTWARE REQUIREMENTS

The Contractor shall provide software which consists of an application encoder solution that enables VA HIM professionals in accurately and consistently medical code determining through code look-up, instructional notes, and references commonly utilized in coding for compliant coding sequence, code value, and present on admission values as required by health care setting and type of care and any warning of potential errors or inconsistencies with official coding guidelines. This software must provide real-time bidirectional software integration with HICBA VIRR software to facilitate storage of all codes into the VA EHR system. The software suite must be implemented within fifteen days of award to eliminate the possibility of enterprise coding backlogs.

SOFTWARE LICENSE AND SUSTAINMENT QUANTITIES

The Contractor shall provide up to 137 encoder software and sustainment licenses per contract year with unlimited number of users at each location. No additional costs should be associated with adding users. The VA anticipates the need to reduce the total number of software and sustainment licenses annually in accordance with VA’s EHR Modernization schedule (https://digital.va.gov/ehr-modernization/ehr-deployment-schedule/). As sites migrate to Cerner, HICBA Encoder software and sustainment licenses will no longer be required at that site and the total license quantity will be reduced at the end of each optional period. The COR will provide the new license quantity to the vendor 30 days prior to the end of each optional period.

The following table is an estimate of licenses needed for each contract year:

Contract Action POP Estimated Licenses Needed

Base (12 months) 12/19/2025 - 12/18/2026 137

Option Period 1 (12 months) 12/19/2026 - 12/18/2027 NTE 137

Option Period 2 (12 months) 12/19/2027 - 12/18/2028 NTE 137

Option Period 3 (12 months) 12/19/2028 - 12/18/2029 NTE 137

Option Period 4 (12 months) 12/19/2029 - 12/18/2030 NTE 137 https://digital.va.gov/ehr-modernization/ehr-deployment-schedule/ https://digital.va.gov/ehr-modernization/ehr-deployment-schedule/

SOFTWARE REQUIREMENTS

The Contractor shall provide a Secure File Transfer Protocol connection with VA or secure alternative in order to distribute new versions and patches to VA in a format compatible with VA and in alignment with Coding Compliance Versioning as outlined by HIPAA Administrative Simplification Act transactions. The Contractor’s solution shall ensure reporting functionalities and knowledge references are consistent and seamless across the VA enterprise regardless of EHR utilization.

The Contractor’s HICBA solution shall have a single user interface from which all information can be accessed. The encoder solution shall interface with the HICBA VIRR solution and is critical for operations and timely exchange of patient data. In addition, the encoder solution shall allow the use of VA’s PIV card system credentials for granting appropriate access to the encoder software.

The encoder must support ICD 9-CM, ICD10-CM, ICD10-PCS, CPT, HCPCS, CDT and other HIPAA Administrative Code Sets required for coding and billing by the HIPAA Administrative Simplification Act for claims data standards. The solution must include a look-up through a series of questions and collected user responses with branching logic from general to more specific and additional details to determine the accurate and most specific code(s) along with the full code description, any instructional notes, and reference or definitions from the code set based on the dates of service and code set versioning. Additionally, the software must contain the ability for the user to see and utilize an electronic book format for code lookup. Both questions/answer and code book methodology must be available in the software to facilitate accurate code selection for use at the user’s discretion.

The encoder solution shall include reporting functionality for analysis and management reporting at the facility, Veterans Integrated Service Networks (VISNs) and enterprise levels. The Contractor shall ensure that reporting and knowledge references will be consistent and seamless across the Federal EHR-implemented and legacy VistA sites.

The encoder solution shall provide a real time bi-directional interface to VHA’s HICBA VIRR solution.

The following list of references and resources are VA standards for HIM across the agency. The Contractor shall ensure all products provided as a result of this procurement effort shall support the standards used within VA.

American Hospital Association (AHA) Coding Clinic

Publication for ICD-9-CM and ICD-10- CM/PCS coding guidelines and advice

AHA Coding Clinic for HCPCS Publication for Level I HCPCS (CPT codes) for hospital providers and specific Level II HCPCS codes for hospitals, physicians and other health professionals.

Clinical Pharmacology Drug Reference

Complete yet concise descriptions of the properties of every drug used in clinical practice.

Coder’s Desk Reference Provides coders, medical staff, payers and health care professionals with a comprehensive and informative guide to a wide variety of commonly asked questions and definitions about the ICD-9-CM code set.

American Medical Association (AMA) CPT Assistant

Publication of the AMA for reporting outpatient ambulatory procedures and evaluation and management services.

ICD-9-CM Code book with the official ICD-9 coding rules and guidelines.

ICD-10-CM/PCS Code book with the official ICD-10- CM/PCS coding rules and guidelines.

CPT of the AMA Code book with the official CPT® coding rules and guidelines.

Diagnostic and Statistical Manual of Mental Disorders (DSM) of the American Psychiatric Association (APA)

Manual covering all mental health disorders for both children and adults. It also lists known causes of these disorders, statistics in terms of gender, age at onset, and prognosis as well as some research concerning the optimal treatment approaches.

Medical Dictionary Illustrated Medical Dictionary Anatomy Plates Illustrated anatomy plates Interventional Radiology Coding Reference

Help coders understand the information needed for coding interventional radiology procedures and provides an extensive pictorial review of the procedures and anatomy associated with interventional radiology procedures.

Faye Brown’s ICD-9 Handbook and ICD-10 equivalent Handbook

Helps coders understand the principles behind the classification system so they can apply the official coding advice found in the industry standard versions of ICD International Classification Clinical Modification.

Dictionary of Medical Acronyms and Abbreviations

Medical acronyms and abbreviations for thousands of new terms from across all medical specialties.

Manual of Diagnostic and Laboratory Tests

Quick-reference source for the latest information on more than 650 diagnostic and laboratory tests.

A. HICBA Encoder Solution with Product Documentation (e.g. Role-based manuals (Users, Administrators, Reporting, etc.)

5.2.1 VA ENTERPRISE CLOUD HOSTING

Because the government intends to install encoder software in the FedRAMP approved VA Enterprise Cloud (VAEC) environment, the Contractor shall provide a cloud-capable software solution.

Additionally, the Contractor shall:

A. Develop, implement and maintain the solution architecture aligned with the VAEC Technical Reference Architecture as well as the One-VA Enterprise Architecture.

Work with VA to provide inputs for establishing VAEC capacity, accounts and privileges. This includes monitoring and tracking the creation, update, and deletion of application user (e.g., developer, systems administrator) accounts, and ensuring cloud capacity requirements are satisfied.

B. Design VAEC hosted solution and address VA identified cloud-readiness gaps.

C. Operate and maintain the solution hosted in the VAEC in accordance with the application and VAEC service level agreements (SLAs) and operate the solution in its current environment in parallel as applicable.

D. Utilize VAEC General Support Services (GSS) when available and applicable in order to minimize cloud services costs and optimize operations. The contractor shall use native tools and capabilities of the VAEC environment.

E. Provide for the backup and recovery of information stored by the solution to meet the application and VAEC SLA using native tools and capabilities of the VAEC environment.

CDI References: MS-DRG/APR- DRG Training Guide, MCC/CC tables, and Disease Progression Tables

Quick-reference source to identify overview of inpatient and outpatient coding processes, HIPAA standard code sets. These references include common missed opportunities in documentation to assist end users in identifications of specific details need by healthcare providers to improve coding accuracy and specificity.

A. Cloud Capable Encoder solution B. Cloud Provisioning requirements C. Solution Architecture D. Solution Design

5.2.2 COMPLIANCE REQUIREMENTS

As part of the Encoder solution, the Contractor shall include compliance monitoring and reporting module along with product manuals. The Contractor’s compliance module shall perform the following:

a. The system shall provide the ability to post VA internal policies, coding guidelines, and billing guidelines within the encoder solution with current online references.

b. The Contractor shall be able to make enhancements to system to support National VHA business process changes/needs through custom edits or notes to display.

c. The Encoder solution shall support user data collection capability outlined by HIPAA standard code set and transaction standard mandated for all HIPAA covered entities and other governing bodies, such as POA, Discharge Disposition, Admission Source.

d. The Contractor shall provide updates to all supported code sets and updates to ensure implementation and availability to end users in compliance with all HIPAA mandated timeframes.

A. Product manuals shall include the compliance capabilities available as outlined in Compliance role.

5.2.3 ENCODER REQUIREMENTS

This encoder solution shall alleviate manual intervention during the coding process as much as possible to increase productivity.

a. The encoder solution shall enable HIM staff to designate the correct ICD and CPT codes used for reporting diagnosis, procedures, services and items provided during encounters and inpatient stays in all healthcare transactions. Requirements involve dependencies with the HICBA VIRR software solution for real-time bi-directional interfacing and storage of data in VistA. The Contractor shall identify specific dependencies and any gaps, and work with the VIRR solution contractor to provide functionalities to meet all requirements. The system shall contain logic that enforces Centers for Medicare and

Medicaid Services (CMS) National Correct Coding Initiative guidelines, instructional notes, and coding edits at point of entry (integrated logic in application). The system logic shall also enforce the following coding guidelines to ensure the correct code is selected and captured in accordance with the HIPAA Administrative Simplification Act transaction standards:

i. Current editions of the ICD, CM and PCS

ii. CPT of the AMA

iii. Current HCPCS

iv. Common Dental Terminology

v. DSM of the APA

b. The encoder solution must include a hierarchical look-up based on user input main terms and a series of questions and collected user responses that utilize branching logic from general to more specific and additional details leading to a code(s), full code description, any instructional notes, and reference or definitions from the code set in support of accurate code selection by the user. Additionally, the software must contain the ability for the user to see and utilize alternative code lookup and selection via electronic book format including code selection, code description, and any/all instructional notes or references that may apply.

Both questions/answer and code book methodology must be available in the software to facilitate accurate code selection for use at the user’s discretion.

c. The system shall be used to provide uniform disease and operation terminology which is complete and scientifically accurate. The code assignment shall be in accordance with:

i. National Center for Health Statistics (NCHS),

ii. CMS,

iii. AHA, AMA, and APA guidelines, as appropriate.

d. Encoder solution shall adhere to all coding guidelines as approved by the Cooperating Parties [the four (4) organizations that make up the Cooperating Parties for ICD in the US]:

i. AHA,

ii. American Health Information Management Association,

iii. CMS,

iv. NCHS

e. Encoder solution shall adhere to all accepted national rules and regulations, including:

i. The Official Guidelines and Reporting as found in the CPT Assistant, a publication of the AMA for reporting outpatient ambulatory procedures and evaluation and management services,

ii. The current Official Guidelines for Coding and Reporting in the Coding Clinic for ICD, a publication of the AHA,

iii. The Correct Coding Initiative. The CPT Evaluation and Management codes assure documentation substantiates the code level assigned.

f. For any service dates prior to 2021 in outpatient setting, the system shall have an Evaluation and Management (E&M) tool for both 1995 and 1997 guidelines incorporated in software logic to assist in selection of appropriate E&M codes. At the administrative level, the system shall have the ability to be set by facility or clinical specialty for the appropriate E&M guidelines.

g. System shall contain VERA patient classification rules for all concurrent and final code determination processes and shall be maintained/updated. Software shall suggest code sequencing to optimize VERA reimbursement and provide a history and reporting output of VERA edits usage, both accepted and bypassed. It shall have the capability for VHA custom edits and allow VERA designation on specific diagnosis and procedure codes.

h. Encoder solution shall include an automated inpatient encoder tool which assists coders with capturing/coding applicable inpatient professional services, including appropriate professional service edit checks.

i. Encoder solution shall allow linking of professional services CPT codes to diagnosis codes and maintaining those links from entry of the patient care encounter through to the HICBA VIRR integrated billing module.

j. System shall automatically suggest code re-sequencing and alternate principal diagnosis/DRG scenarios to satisfy applicable edits and rules that are enforced in logic.

k. Encoder solution shall include online electronic coding reference books and links to relevant anatomical diagrams to be used to provide uniform disease and operation terminology which is complete and scientifically accurate. Code References shall be updated quarterly or at a frequency deemed appropriate per HIPAA code set standards. The product shall provide ability to research, save and print online reference materials.

Electronic Code Reference books listed under requirements in Section 5.2, shall be available within all system modules. Coding references shall be consistent across the Federal EHR-implemented and legacy VistA sites.

l. Encoder solution shall automatically assign the appropriate MS-DRG to discharges based on dates of service (integrated MS-DRG calculation) and APR-DRG as a secondary DRG calculation for all discharges, including risk of mortality and severity of illness discrete data values. The solution must be able to include in individual record transactions details regarding MS-DRG and APR-DRG for storage into VistA via the HICBA VIRR vendor product for each inpatient record.

m. Ambulatory Payment Classification (APC) Grouper shall be integrated with the Software Solution Suite to automatically assign the correct APC codes and calculate accurate reimbursement.

n. Encoder solution shall allow free-form text entry within inpatient encoder tool for cross-walking ICD procedure codes.

o. Encoder solution shall present an indicator on HCPCS codes with more than two modifiers. This will provide a quick view of modifier combinations.

p. Encoder solution shall provide customizable views of procedure information (CPT/HCPCS/ICD procedures) for coders, allowing them to collapse and expand the procedure grids as they are coding encounters.

q. Inpatient encoder tool must include CMS DRG analyzer that includes weight and reimbursement differences.

r. The Encoder solution shall support the functionalities below with the HICBA VIRR software solution. As part of the transition-in task, the Contractor shall evaluate the VIRR solution to determine where gaps exist in these requirements and further product customization is required. The contractor shall work with the VIRR Contractor to report gaps to the government and coordinate with the government and VIRR Contractor to provide the required functionality.

1) Encoder solution's inpatient encoder shall have ability to code and generate MS-DRG and/or APR-DRG details for Patient Treatment File portions of an inpatient stay based on the changes in bed accommodation (treating specialty) changes referred to in VHA as movements within an inpatient stay, e.g., single patient stays involving transfer upon leaving the Intensive Care Unit, Psychology Ward, etc., have a DRG for the days involving only the time in the specified bed type. Encoder solution shall have logic that automatically checks codes to ensure they are correct for the associated date of service, patient gender, age, disposition, and care setting type. Logic shall also validate that modifiers entered for CPT/HCPCS codes are appropriate. Logic shall also automatically notify coder if a secondary diagnosis code is required.

2) Encoder solution shall provide the ability to code and maintain hospital records both interim and at discharge.

3) Provide real time bi-directional data integration with HICBA VIRR vendor to facilitate data collection pertinent for clinical indicators to accurately represent the Veteran’s severity, acuity and risk of mortality.

4) The solution must include the capability to incorporate VHA custom edits, e.g. custom VHA edits of common codes missed or sequencing rules.

5.3 TECHNICAL SUPPORT

5.3.1 TECHNICAL AND ON CALL SUPPORT

The Contractor shall provide technical and Help Desk support for HICBA capabilities.

The Contractor shall provide a designated POC for direct communications from VA to the Contractor’s technical support. The Contractor shall provide live on-call support, staffed by technical professionals, for VA Monday through Friday between the hours of 8:00am and 7:00pm Eastern Standard Time except for Federal holidays.

The Contractor shall provide telephone lines to handle call volume with Automatic Call Distributor and Service Desk functionality to record call date, time, hold times, and duration information, and electronic interface to all systems for monitoring and reporting. The Contractor’s on-call support shall include a toll-free phone number, transparency, triage, tracking, and reporting. Transparency in Service Desk/Help Desk System requires that when a requestor initiates a problem ticket, there is the appearance of one help desk organization, including one help desk number. Once processed, regardless of if via a local or national desk, it should be propagated throughout the VHA so that the people located remotely who are working to resolve the issue should be able to view the ticket without requestor reentering it into a new system.

Immediately upon receipt of a call from VA the call shall be logged, and a tracking number assigned and given to the caller reporting the issue. Hand-off shall be made to the appropriate technician. The Contractor shall work with the callers to resolve issues.

The Contractor shall create a Ticket which minimally include a unique identifier (ticket number); name of service requester, location, priority,…