Attachment_J.1_Statement_of_Work.docx

Post-acute Program Analytics, Outreach and Support, 05/29/19 Attachment J.1 – Statement of Work

STATEMENT OF WORK/SERVICES

1. CONTRACT PURPOSE

This statement of work pertains to the data analytic and technical support needed for five (5) Post-Acute Care (PAC) Quality Reporting Programs (QRP). The Home Health (HH) QRP was established in response to 5201(c)(2) of the Deficit Reduction Act (DRA) in 2007 which ammended Section 1895(b)(3)(B)(v)(II) of the Social Security Act (SSA) to require that Home Health Agencies (HHA) submit data on quality measures. Further, Section 3004 of the Patient Protection and Affordable Care Act (ACA) ammended §1886(m)(5), §1886(j)(7) and §1814(I) of the SSA, requiring the reporting of data on quality measures by Long-Term Care Hospitals (LTCH), Inpatient Rehabilitation Facilities (IRF) and Hospices, respectively. In addition, the Improving Medicare Post-Acute Care Transformation Act of 2014 (the IMPACT Act) required data reporting requirements for Skilled Nursing Facilities (SNFs) and further ammended sections 1886(m)(5) and, 1886(j)(7) of the SSA as well as Sections 1895(b)(3)(B)(v) and 1888(e)(6), further specifying data submission requirements in the SNF, LTCH, IRF and HH QRPs. For all five (5) QRPs, failure to submit the required data results in a reduction the provider’s annual payment update of two (2) percentage points. Thus, this Contract supports data analysis work pertaining to the Post-Acute Care (PAC) QRPs.

The primary functions of this work include data analyses to support annual payment update determinations, development of technical public reporting and other data reporting requirements and business process models, and monitoring and evalation activities. Further, this work is to provide programmatic technical support to stakeholders in relation to the Hospice, IRF, LTCH, SNF and HHA QRPs’ including but not limited to policies and procedures, provider reports, programmatic technical assistance, and provider outreach and communications. Additionally, this contract shall support stakeholders including, but not limited to providers, the Centers for Medicare & Medicaid Services (CMS), and other Federal partners, to achieve success in the reporting of standardized assessment data, quality measure data, resource use and other measure data. A support contractor for these programs is necessary so that CMS can monitor and identify program reporting compliance and continue performance measurement and quality improvement at the National level.

2. BACKGROUND AND OVERVIEW

CMS is the Federal agency that administers the Medicare, Medicaid, and Children’s Health Insurance Program (CHIP) programs. CMS seeks to promote higher quality and more efficient health care for Medicare beneficiaries, and our efforts are furthered by quality reporting programs coupled with public reporting of that information. Quality reporting programs already exist for various settings such as hospital inpatient services via the Hospital Inpatient Quality Reporting (IQR) Program, hospital outpatient services via the Hospital Outpatient Quality Reporting (OQR) Program, and physicians and other eligible professionals’ services via the Merit-Based Incentive Payment System Program (MIPS)

In addition, Quality Reporting Programs have also been established for Post-Acute Care, which are the Hospice, IRF, LTCH, SNF, and HHA Quality Reporting Programs. HHAs began data collection and reporting in 2007. Hospice, IRF, and LTCH providers began data collection for the QRPs in 2012 and the SNFs began data collection data in 2015. These five (5) QRPs comprise CMS’s Post-Acute Care Quality Reporting Programs.

The work under this contract aligns with the work and mission under Section 3004 of Health Care Reform H.R. 3590, Quality Reporting for Long-Term Care Hospitals, Inpatient Rehabilitation Hospitals, Hospice Programs amending Sections 1886(m), (j) and 1814(i) of the Social Security Act (42 U.S.C. 1395) respectively. In addition this work further aligns with the work and mission associated with the additional data reporting requirements as established under the IMPACT Act which amended the SSA by adding Section 1899B, “Standardized Post-Acute Care (PAC) Assessment Data for Quality, Payment and Discharge Planning.” Under Section 1899B, §1886(m)(5); §1886(j)(7) Act; as well §1895(b)(3)(B)(v) and §1888 (e)(6) were amended whereby additional and cross-setting post-acute care data reporting requirements were established for IRFs, LTCHs, SNFs, and HHAs. These statutory requirements are applicable across the four post-acute care quality programs, as specified under the IMPACT Act.

Therefore, it is important to note that the reporting mandates established under both sections 1886 (as modified by ACA Section 3004) and 1899B of the SSSA (as amended by the IMPACT Act of 2014) are intricately related. Section 1899B requires modification of sections 1886(J)(7) and 1886(m)(5) to include additional data submission requirements as established under 1899B for IRFs and LTCHs. Further, Section 1899B of the Act requires modifications to Sections 1895(b)(3)(B)(v) for HHAs and 1888 (e)(6) for SNFs which are consistent with and include the same data reporting requirements (and penalties for failure to submit such data) as specified under 1886(J)(7) and 1886(m)(5) for IRF and LTCH quality data reporting. All four (4) providers are required to meet common data reporting requirements as specified under the IMPACT Act.

Furthermore, this project supports the administration of the Quality Improvement Organizations Program (QIO). The Social Security Act, as set forth in Part B of Title XI - Section 1862(g), established the Utilization and Quality Control Peer Review Organization Program, now known as the Quality Improvement Organizations Program. The statutory mission of the QIO Program is to improve the effectiveness, efficiency, economy, and quality of services delivered to Medicare beneficiaries. Therefore, in addition to its support of the QIO Program; 5201(c)(2) of the DRA data reporting requirements analysis for HHAs and Section 3004 of the Affordable Care Act data reporting requirements analysis for Hospices, IRFs, and LTCHs, support is extended to include the data reporting analysis as established by the IMPACT Act of 2014 and its amendment of the SSA with the addition of Section 1899B under Title XVIII of the Social Security Act and the cross-PAC provider data reporting requirements that were expanded for IRFs (§1886(J)(7)); LTCHs (§1886(m)(5) ); HHAs §1895(b)(3)(B)(v) and established for SNFs (§1888 (e)(6)). Thus, this contract supports the data analysis (e.g., determining provider compliance) associated with the LTCH, IRF, Hospice, HH and SNF QRPs, and provider-related analytic support activities (e.g., help desk support).

HQCIS Collaborative Analytics and Data Sharing (CAADS) Platform Overview

The HCQIS CAADS platform provides CCSQ with an intuitive, best-of-breed big data solution that maximizes CCSQ’s ability to offer meaningful insights into their data. The HCQIS CAADS platform is provided as a cloud offering in the HCQIS AWS Hybrid Cloud to support CMS quality improvement programs. The HCQIS CAADS platform ingests data from external sources into a distributed, scalable data store. Once the data is ingested into the CAADS Enterprise Data Lake, the data is cataloged in the data store and made accessible through role-based access control for the fulfilling of functions such as data searching, visualizing, analyzing or collaborating.

The HCQIS CAADS enables Post-Acute-Care analysts to access their data through data preparation applications, analytic tools, and reporting applications. All CAADS applications are browser-based and integrated with the HCQIS Active Directory.

The table below provides summary of the specific tools currently used within the CAADS environment.

· Provides visual analytics and dashboards through a drag-and-drop interface.

· Create joins, derive fields, rename columns, filter data, and manage analytical views.

· Visual data ingest and transformation tools to cleanse, transform, prepare and profile data.

· Provides column and row calculations that allow users to perform basic analytics and report preparation.

· Provides collaboration tools for users to create local workspaces, workflows, selecting and combining data sources, perform analytics, and share their work

· Allows users to export models to PMML

Figure 1. HQCIS CAADS Environment High-Level Architecture Diagram

3. STATEMENT OF WORK

Task 1: Task Management

The Contractor shall complete the following:

a) Kickoff Meeting

Within ten (10) government business days of the award of this contract, the Contractor shall conduct a contract kickoff meeting and briefing plus record notes and action items. The meeting will be in-person in the Base Period at CMS in Baltimore, MD, and Option Periods at the discretion of the Contracting Officer Representative (COR). The Contractor shall deliver materials for the kickoff meeting, including the agenda and any meeting materials including slide briefings or handouts, to the COR a minimum of five (5) business days before the meeting.

The completion of this meeting shall result in (but is not limited to) the following:

1. Introduction of both Contractor staff and Government personnel performing work related to this contract.

1. Overview of the process and timeline for meeting SOW requirements, contract administration, and reporting.

1. Review by the Contractor of its understanding of the work to be accomplished under this Statement of Work (SOW) to ensure that all parties have a common understanding of the work to be performed and of the respective responsibilities and obligations of the parties to that end.

1. Review by both CMS and the Contractor of the agreed-upon method to resolve, track, and report on issues.

1. Development of a list of any additional Government-Furnished Information (GFI) required.

The Contractor shall record and deliver minutes from this Kickoff, with an action item summary, within two (2) business days following the Kickoff Meeting.

Deliverable 1: Kickoff Meeting Deliverable 2: Kickoff Meeting Agenda and Meeting Materials Deliverable 3: Kickoff Meeting Minutes

b) Project Management Work Plan and Reporting

The Contractor shall provide Program Manager (PM) oversight for this contact and provide an individualized project work plan for each program. In addition, in consultation with the COR, the Contractor will identify where/how efficiencies can be made in such artifacts and in the overall activities. CMS will approve the project management work plan or provide comments for revision within ten (10) business days of delivery of the project work plan. The project management work plan may be revised as needed throughout the period of delivery; however, the project management work plan may not be revised more than monthly, as mutually agreeable to CMS and the Contractor.

In addition, the Contractor shall provide:

· An executive level dashboard for each program. The Contractor shall update each program’s dashboard no less than once a month, specific day(s) of month as agreed upon by COR, and provide weekly schedule updates in Microsoft Project, or other mutually agreed upon software, that will be included in CMS’ integrated program master schedule. This project schedule must be baseline, and shall include each task’s status notated as percent complete.

· Maintain a tracking log of risks, issues, and action items

· Provide monthly status report to ensure that the expenditure of resources is consistent with and will lead toward successful completion of all tasks within projected cost and schedule limitations.

· This detailed report shall contain all relevant progress information of the preceding month, progress expected during the next month, resources expended, any significant problems or issues encountered, recommended actions to resolve identified problems, and any variances from the proposed schedule.

· The report shall list all of the updates regarding each task, subtask, or deliverable and place emphasis on substantive information, progress, and changes to the SOW including:

· Achievements and accomplishments

· Upcoming milestones and events in the next four (4) months

· Staffing changes

· Funds expended to date and remaining balance

· Summary report of the project progress (one (1) to three (3) pages) including the details of the monthly activities and accomplishments, financial overview, and upcoming timeline and deliverables.

Deliverable 4: Project Management Work Plan Deliverable 5: Executive Level Dashboard Deliverable 6: Monthly Status Report Deliverable 7: Monthly Financial Report

c) Weekly Contract Management Call

The Contractor shall participate in at least one weekly contract management call with the CMS COR. The Contractor shall review the risks and issues tracking log at these weekly meetings, and shall document the meeting outcomes and action items. The frequency of the contract management call can be negotiated by mutual agreement by CMS and the Contractor.

Deliverable 8: Weekly Contract Management Call

Task 2: Program Education and Communication

Education and Outreach are an important part of ensuring provider success with the Quality Reporting Programs. In order to ensure providers have the necessary information to successfully and accurately report PAC data for Hospice, IRF, LTCH, SNF, and HHA to CMS, the contractor shall:

a) Develop Provider Communications

The Contractor shall support the implementation of any new data reporting requirements for the PAC programs such as new measures and/or other activities relevant to the program requirements and needs (e.g, natural disasters), develop supporting materials, provide input and recommendations, and participate in meetings, as directed by the COR. Supporting materials may include but are not limited to the following communications:

· email blasts

· website announcements

· frequently asked questions documents

· how to/quick reference guides

· newsletters

· notifications via provider report folder in the CMS data submission system

· ListServ notifications

· Webinar-based trainings pertaining to topics such as Annual Payment Update (APU) compliancy requirements and quality reporting provider reports.

Deliverable 9: Provider Communications

· All content will be delivered in a 508 compliant format unless otherwise directed by the COR

b) Provide website content management/support in the form of reviewing and maintaining website textual content and assistance in drafting language for CMS websites. Conduct quarterly reviews of the program websites and provide recommendations and mockups including:

· Conduct an initial review of content on CMS.gov webpages and create a survey of resources available to be downloaded.

· Ensure timely and accurate content.

· Inventory these resources in a spreadsheet that summarizes all attachments by URL location, summary of the purpose of that URL landing page, the intended audience, the downloadable file name, file type, associated program name, file content, file size, and a Contractor-provided recommendation for expiration date for the attachment and/or the date that the content must be updated to remain viable on the website. Report on activities.

· Maintain this spreadsheet and include it in a semi-annual report to CMS. The Contractor will use the recommended expiration/update field to suggest and to execute updates to resources or change how Web content is organized for the benefit of the users of the content, at CMS request or with CMS approval. The Contractor is expected to work with other CMS contractors to facilitate these changes. Report on activities.

· Recommend content for archiving.

· Prepare new content for the website, as needed, with CMS approval.

· Maintain final drafts of all Education and Communication materials for version control.

Deliverable 10: Report on website reviews Deliverable 11: Report on Program website updates

c) Track and update the outreach and communications for each of the post-acute care programs on an annual basis related to APU, data submission reminders, compliance activities, and other related topics as needed. The contractor is expected to work with other CMS contractors, as needed, to capture routine communications and outreach not performed by the Contractor, such as Open Door forums, rule announcements, and other related topics as directed by the COR.

Deliverable 12: Annual communications plan.

Task 3: Determining Compliance Status for Hospice, IRF, LTCH, SNF and HHA Quality Reporting Programs

In order to assist CMS in determining compliance, the Contractor shall obtain access to the necessary databases needed to obtain the data for Hospice, IRF, LTCH, SNF, and as necessary HH, in order to perform the analyses described in this SOW. In addition, the contractor will be required to attend CAADS overview and hands-on trainings as identified by the COR and ISG CAADS Implementation team. The contractor will be required to assume and maintain current operational activities within CAADS platform related to the PAC Program analytics. The Contractor shall:

a) Register for, obtain an account in QualityNet if needed, and work with the Centers for Disease Control (CDC) to receive scheduled National Healthcare Safety Network (NHSN) files.

· within 30 days of the contract award

b) Register for HCQIS Active Directory accounts, as well as Confluence and JIRA, to enable access to the PAC assessment data in the HCQIS CAADS environment in order to generate the compliance determination files.

· within 15 days of the contract award

c) Attend CAADS trainings as identified by the COR. Based on the contractor’s experience and level of knowledge about the CAADS solution and PAC Program analytic requirements, the following activities may be required, including but not limited to:

· Participate in an overview and demonstration of CAADS. The outcome of this session is that DCPAC users will have an understanding of CAADS and how to apply to the DCPAC tasks.

· Participate in hands-on onboarding activities with the CAADS team to take over responsibilities for the data ingest pipelines, data visualizations, and data analytics, as defined by this SOW and required by the COR.

· Utilize the self-training modules provided through the CAADS Confluence page and also engage with the CAADS team for support for effective use of the tools.

· Complete all required training per the timeline defined by the COR.

d) Assume and maintain current operational activities within CAADS platform related to the PAC Program analytics, including but not limited to the following:

· Assume operation of the data ingestion pipelines into the CAADS data lake for data such as assessment, provider, claims, and CDC-provided hospital measures as appropriate for DCPAC mission and defined by the COR.

· Assume operation of the existing PAC analytics and dashboards as implemented in the CAADS environment.

· Revise and refactor analytics and dashboards implemented in CAADS in accordance with the Business Process Model (BPM).

· Work with the CAADS team on continuous improvement activities to streamline the process and enable cost efficiencies.

· Work with the CAADS team as appropriate to resolve platform, tool access, performance, or other issues. Some issues, such as access to the HCQIS network, may require the DCPAC contractor to work with the HCQIS infrastructure contactor.

· Complete all requirements per the timeline defined by the COR and outlined in Deliverable 4.

e) Develop business requirements and business process models for capturing the data analytics processes used in generating the compliance determination files for each of the PAC programs. This should include documentation for combining the results of the NHSN data from the CDC, CAHPS data, and other data, if applicable, being reported from outside sources used in conjunction with the individual PAC assessment instruments to determine compliance.

Deliverable 13: Annual business requirements and business process model for each PAC program to capture compliancy analytics process.

f) Reconcile quality reporting data gathered from separate data collection systems for each provider to determine compliance with CMS’ quality reporting requirements.

g) Monitor facilities-submitted quality data to provide support to reporting facilities and CMS regarding the completeness of data submissions, and analyze for provider trends in data reporting behavior.

h) Perform quarterly data analytics and submit quarterly program level electronic lists, by program area, to CMS of facilities that have not submitted data. The lists should contain, at a minimum, the following information: “Facilities Not Submitting Assessments”; “Facilities not Submitting Complete National Healthcare Safety Network (NHSN) data” and “Facilities Not Submitting Consumer Assessment of Health Care Provider and Systems (CAHPS) data” as appropriate. Additional lists may be identified or frequency of lists may be changed as requirements/measures change. For example, a monthly report may be needed to ensure compliance with the first reporting quarter of a new measure, but may be decreased to quarterly after the initial measure submission. Examples of additional monthly lists may include: facilities that have closed, future close dates, and facilities that have not submitted records for validation. Examples of annual lists may include facilities at risk of not meeting the Annual Payment Update (APU).

Deliverable 14: Quarterly program level compliancy lists

i) Targeted outreach to PAC providers not meeting the assessments and/or CDC National Healthcare Safety Network (NHSN) requirements should occur no later than ten (10) business days prior to the quarterly data submission deadlines (for IRF, LTCH, and SNF), and as directed for Hospice and HHA, if an issue of incomplete data submission is detected. No outreach is required for facilities that request not to be contacted. Current rate of non-compliance for PAC providers averages 5-10% for each provider type.

Deliverable 15: Quarterly report on Outreach for each of the post-acute care programs

j) Provide a list to CMS of facilities (including HHA when applicable) that meet or do not meet each APU criteria; the list should be provided in a tool that will allow CMS to view determinations by the APU requirements. The tool should identify the percentage of facilities that do not meet the APU for each criteria as stratified to allow CMS to determine the final decision list. In addition, the list should include details for exceptions and exemptions, when applicable, for extraordinary circumstances, such as natural disasters, as directed by the COR. The list prepared for the fourth quarter of an APU period shall contain consolidated data for the annual Fiscal Year (FY) or Calendar Year (CY) APU compliancy determinations.

Deliverable 16: Quarterly PAC program APU list

k) Provide all communications with providers, including supporting documentation for reconsideration requests, to the reconsideration contractor in a format agreed upon by both contractors. Provide any additional documentation the reconsideration contractor may need in order to make well informed decisions regarding reconsideration requests.

Deliverable 17: Weekly communications tracking log

l) Once all reconsideration requests are completed (including HHA when applicable), provide CMS with a final file of providers that includes initial APU status, final APU status and all relevant information regarding any change in status.

Deliverable18: Final APU file for each PAC program

m) Prepare/assist in the development of briefing documents/materials related to APU (including HHA when applicable)

Deliverable 19: Draft Pre-Reconsideration APU briefing documents Deliverable 20: Draft Post-Reconsideration APU briefing documents

n) Generate the initial and final notification letters of non-compliance that are sent via the CMS data submission system notifying providers they are subject to the 2% reduction in their annual payment update. Regulation text for the PAC programs also identifies the US Postal Service as a potential method for these notification letters. Contractor will be responsible for preparing and mailing initial and final notification letters sent via USPS. The method of notification decision will be made by CMS prior to finalization of the pre-reconsideration compliance list.

Deliverable 21: Initial notices of non-compliance determination Deliverable 22: Post-reconsideration final notice of non-compliance

Task 4: Help Desk Support

Maintain a Help Desk, with program specific mailboxes, for questions that require knowledge of the Quality Reporting Program compliance programs. The inquiries are provider-specific and often are related to data submission requirements associated with the compliance thresholds. The Help Desk would be staffed with program subject matter experts, able to assistance with program compliance issues. The Contractor will work closely with other help desks that may also support different aspects of the programs such as quality measure support or data collection systems support.

The Contractor shall:

a) Register for Service Now accounts to enable monitoring of the PAC reconsideration mailboxes and response capability according to Information Systems Group (ISG) requirements.

· Within 30 days of contract award

b) Monitor responses to providers, including but not limited to:

· grammar

· spelling

· formality of style

· accuracy of information provided in responses

· completeness and extent of addressing asked questions

· filtering of inappropriate and unrelated questions

· timeliness

· filtering of duplicate questions

c) Develop a tracking tool, for each provider type, for questions/responses to include:

· date of receipt of question

· CMS Certification Number (CCN) of submitter

· type of provider/facility/company name

· original question

· date of question acknowledgement (to submitter)

· date of CMS submission

· date of draft-response receipt (from CMS)

· date of submission to CMS for approval

· date of approval (from CMS)

· CMS-approved response (answer)

· date of answer-response to submitter

d) Review and update answers contained in the tool either directly or with subject matter input, and

e) Develop timeline and format for reporting, to CMS or other contractors, questions received by the mailboxes

f) Work with other contractors that may need regular, timely reporting of questions submitted to the mailboxes, especially during high volume periods of reconsiderations

g) Assist CMS by drafting answers for CMS approval in response to questions received in the mailboxes and generate a database to capture responses previously approved by CMS.

· 95% of public questions shall be answered and submitted to CMS for approval within two (2) business days following receipt unless forwarded to another, appropriate party or as otherwise directed; questions that require forwarding to another party shall be forwarded within five (5) business days. Problems and significant issues must be reported as soon as possible to the COR

h) Anticipate questions and prepare answers that may occur following an event (natural disaster or reconsideration period closure) or program change

i) Provide all operational support of the CMS-designated Hospice, IRF, LTCH, SNF, and HHA Program Reconsideration/Exemption/Exception Mailboxes questions via Service Now requirements.

j) Work with CMS or designated security contractor and coordinate activities related to security issues, including processes for handling HIPAA, if applicable.

· All noted security issues must be discussed within two (2) business days with notification of the COR

Deliverable 23: Monthly Report of Help Desk activities

Task 5: Support for Data Collection, Public Reporting, and Rule Writing:

CMS is required to establish procedures related to data submission requirements and for making data available to the public and to ensure Hospice, IRF, LTCH, SNF and HH quality reporting programs have the opportunity to review that data prior to public reporting. The Contractor shall support CMS during the Notice of Proposed Rulemaking (NPRM) and the Final Rule processes specifically regarding the form and manner sections of the rules pertaining to PAC quality reporting programs, as needed.

To ensure CMS meets these requirements, the Contractor shall:

a) Provide subject matter expertise on all procedures necessary for providers and vendors to submit data to CMS including:

· Standard data format

· Import and export of CMS data from the national database

· Access to reports and other resources on the CMS designated system portal (currently the Quality Improvement Evaluation System (QIES)). It is expected that the Contractor will also be an active participant supporting the PAC programs as they transition to the Internet Quality Improvement Evaluation System (iQIES) so they will be able to provide support for providers and vendors following the conversions.

· Coordination with other CMS contractors on responses to questions related to data submission

· Electronic specifications for measures submission as it becomes available

b) Applying lean principles, the Contractor shall assist with the development of business requirements for the provider reports, including provider public reporting preview reports and final data file exchanges for all quarterly and annual public reporting releases for the PAC programs. This task includes, but is not limited to:

· Understanding each program’s data requirements related to public reporting e.g., provider pre-publication preview reports and final quality measure data files for final publication

· Providing program specifications for the development of business requirements

· Participating in peer review sessions for the requirements to assure accurate interpretation for implementation of the business requirements.

Deliverable 24: Develop business requirements and business process models (BPMs) documenting the reports/data file specifications and exchanges required to support the annual public reporting releases.

c) Provide technical/subject matter expertise for inclusion in regulatory preamble, regulatory text and in response to public comments submitted during the comment period after the publication of the Notices for Proposed Rulemaking, as needed.

Task 6: Additional Business Requirements and Business Process Modeling for the Quality Reporting Programs

The Contractor shall advise information technology (IT) contractors when policy changes may require further assessment of infrastructure to accommodate successful submissions and support needed changes to quality reporting program provider reports.

a) Applying lean principles, the Contractor shall assist in developing and updating of IT business process models for the PAC quality reporting programs for systems releases or changes, as directed by the COR.

Deliverable 25: Develop business process models, as directed by the COR

b) Create business requirements for the quality reporting programs provider reports, (e.g. confidential feedback reports (QM reports), review and correct, and provider threshold reports), and provide support for other reports, or other system changes, necessary to support quality reporting program policy changes. Applying lean principles, participate in all business requirement elicitation, development and overview for finalization meetings for all system releases as required to capture changes in requirements as a result of policy, or process, changes.

Deliverable 26: Develop or assist in the generation of business requirements for provider quality reporting program reports, or other system changes necessary to support policy changes, as changes occur, as directed by the COR.

Task 7: Administrative Tasks

The Contractor shall provide the following administrative support:

a) Assist the COR in Program Management

· Schedule weekly teleconference calls with CMS staff. The frequency of these meetings can be negotiated based on mutual agreement between contractor and the COR.

· Provide a brief weekly summary of key issues/milestones in MS Project, or other mutually agreed upon software.

· Prepare agendas, minutes and attachments. The expectation is that agendas be provided at least 48 hours in advance of the meeting with hot topic items identified.

· Review the project timeline with the COR, and update as necessary

· Serve as a point of contact as assigned and coordinate with other CMS contractors supporting the post-acute care quality reporting programs and other CMS components, as directed by the COR.

· Assist with preparation of materials for use by the COR in presentations and other official communications

· Assist with coordination and facilitation for “in person” or Video conference meetings

b) Submit an annual report of contract activities within 30 days following the end of the annual performance period. The Contractor shall submit one (1) draft annual report for the COR to review and comment and a final annual report within 15-days after receipt of the COR comments. The COR shall provide feedback (if necessary) on annual reports via conference call and in writing. An annual report shall be submitted at the end of the base period, and at the end of each option year.

· The format shall be narrative with descriptive tables and/or charts and include the following:

· Table of contents

· Executive summary

· Summary reports from each monthly report

· Total program expenditures to include spending analysis/total expenditures, by month, by task, etc.

Deliverable 27: Annual Report of Contract Activities

c) Prepare a final report summarizing activities over the contract, including a summary of all deliverables, lessons learned, and data in progress. This final report takes the place of the annual report in the final year of the contract. In addition, an overall summary of significant aspects of the work that was conducted from the base and all option years under this contract should be included in this final report. The structure of the report should be similar to that used for the annual report. However, with approval from CMS, the contractor may request to make additions and/or modifications to the annual reporting format. The COR shall provide feedback on the final report within two (2) weeks of receiving the draft. The contractor shall submit the final report at least 15 days before the contract ends.

Deliverable 28: Final report of contract activities (Final Year Only)

Task 8: Data Analyses

The Contractor shall develop templates necessary to produce reports to identify each provider’s compliance with CMS’ quality reporting requirements. These templates shall be generated using CAADS tool and compliance analysis data available in the CAADS Enterprise Data Lake.

a) Perform quarterly and annual data analysis and create options papers to support future policy decisions for quality reporting

Deliverable 29: Perform quarterly and annual data analysis to support policy decisions

b) The Contractor shall provide ad hoc data analyses in support of Quality Reporting for PAC as requested by the COR, with appropriate negotiation of due dates based on existing workload under this Statement of Work

c) Approximately 20 ad hoc analyses per year expected

Deliverable 30: Provide Ad Hoc data analysis

Task 9: Monitoring and Evaluation

It is essential to perform monitoring and evaluation (M&E) activities over the life of a program to understand how well the program is meeting its intended goals and to discover any need for program improvement. Monitoring, defined as an “early warning” system, is implemented at the start of a program to track the positive, negative, or unanticipated effects of the program in real time. Evaluation is designed to determine the causes of outcomes. Statistical analysis is used to explain the significance of factors that may or may not influence the program’s ability to meet its stated goals.

The Contractor shall:

a) Conduct meetings with CMS to discuss an M&E strategy and reconcile any questions regarding evaluation scope, data availability, and other considerations before conducting any monitoring or evaluation analysis. This strategy could be a recommendation from the Contractor, CMS-provided, or a combination based on mutual agreement between Contractor and CMS.

b) Develop monitoring and evaluation implementation plan based upon agreed strategy as directed by the COR.

· Scope of the evaluation

· List of data elements required for evaluation

· Performance measures and targets

· A data collection plan

· Data analysis techniques and methods that will be used for the evaluation

· Report template, including a description of graphics and tables that will be used to communicate evaluation results.

Deliverable 31: Monitoring and Evaluation Implementation Plan, as directed by the COR

c) Perform monitoring and evaluation activities as described in the M&E strategy. These activities may include, but are not limited to:

· Analysis of providers meeting all, some, or none of the reporting requirements

· Analysis of provider progress towards performance measure targets, as defined in the M&E strategy

· Analysis of Program updates, challenges, and successes that impact provider participation and compliance

· Year-over-year trend analysis of outcomes relating to implemented quality measures

· Results of analysis reported to CMS no less than annually

Deliverable 32: Monitoring and Evaluation Activities

Quality Assurance

CMS expects the Contractor to embed a quality assurance process within each task and to produce high quality deliverables. The Contractor shall have key personnel with appropriate knowledge, skills, and expertise to accomplish these tasks and mechanisms in place to ensure that staff is properly trained regarding this initiative.

In addition, the contractor shall conduct 100% validation check of all data files submitted. All data shall be validated according to the established business rules and data collection protocol.

Information Technology (IT) Requirements

The Contractor shall:

· Ensure any new data environments in support of this task order are required to be created within the HCQIS FISMA boundary. The contractor is required to submit for CMS approval, and subsequently execute, a transition plan to move any pre-existing environments proposed for use in support of this task order to an environment within the HCQIS boundary.

· Not share information with anyone outside the scope of this contract, unless the CMS Contracting Officer (CO) and Contracting Officer Representative (COR) have provided written consent, because tasks required in this contract involve sensitive information and require security and confidentiality of data, analyses, rulemaking, and program support.

· Ensure all written and electronic deliverables to be 504/508 compliant.

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services. The contractor shall ensure that any deliverable submitted under this contract shall be deemed 508 compliant.

Deliverable Requirements:

The Contractor shall provide the deliverables listed under the Schedule of Deliverables.

The Contractor shall submit documents formatted ready to print, in Times New Roman 12 point font. Except for drafts of letters, all files shall include header information with a succinct description of the file’s content, including the applicable program name fully spelled out the first time it is used, with the acronym in parentheses. File headers must also include a description of data presented, including the data source and the data time period (the time period must be specific to type of time period, i.e., encounter/discharge period, deadline, payment determination, etc.). Documents shall include footer information with the page number (out of total pages); contact information including a phone number for questions, and the date content was updated.

Contractors must use good grammar, clear writing, and order of ideas. This includes spelling out acronyms the first time they are used, writing in active voice, writing in plain language whenever possible, and clearly identifying time periods (e.g. discharge period, payment period, deadline, etc.). This also includes fully articulating the range of months and years in a quarterly period. (For example, a reference to Q1 – Q3, 2016 must also additionally provide parentheses to explain that this indicates the time period January 1, 2016 through September 30, 2016). All reports and analysis shall include a cover page with a brief description of the content, any relevant history that preceded the report and a full description of the methodology utilized to collect/analyze data. The methodology description shall be a dedicated section/paragraph of the cover letter and shall include such items as: all data sources, specific data elements (as appropriate), inclusion criteria, exclusion criteria, etc.

When using a CMS template, the Contractor shall ensure that it is using the most up to date version of the template.

Documents shall not include Contractor logos or business names and be in 508/504 compliant format. In education and outreach materials, the Contractor shall refer to itself by role, e.g. “IRF, LTCH or Hospice Support Contract” or another working title as approved by CMS.

Transition Plan:

The Contractor must be capable of implementing the on-going work under this statement of work while accommodating transitions to a new contractor or a new contract vehicle, if necessary. The contractor shall develop a Transition Plan that specifically addresses its methodology to prepare and execute its transition to complete the work outlined in this Statement of Work. The Transition Plan must be approved by CMS prior to deployment and be implemented 60-days prior to the end of the contract.

The Contractor shall submit a transition plan containing:

· An approach for training or acquiring necessary staff to ensure that there is no lapse in technical and educational support to CMS and all stakeholders

· A mapping of staff into a skills matrix demonstrating those necessary for completing all tasks under the current and new contracts

· An approach for completing task order planning without affecting ongoing work and work management

· A quality assurance plan and performance metrics for the transition

· Detailed risk analysis and mitigation strategies to minimize disruption of services

· A scheduling of action items required to complete the transition, including a plan for management of all meetings, interviews, events/milestones, and exchanges of documents/ information.

4. GOVERNMENT PROPERTY:

N/A

5. STANDARD SECURITY CONTRACT LANGUAGE

Federal Security Mandates As mandated by the Federal Information Security Modernization Act of 2014 (Public Law 113-283) (FISMA), all federal agencies, as well as the contractors and subcontractors (hereafter referred to as “the Contractor”) supporting those agencies, must develop, document, and implement an Information Security (IS) program to safeguard information and information systems. FISMA applies to any organization which has physical or electronic access to a federal agency’s computer systems, networks, or information technology (IT) infrastructure; or uses information systems to generate, store, process, or exchange data with, or on behalf of, a federal agency. This includes the external third-party/outsourced and cloud hosting of agency information or information systems.

Contract Types and Applicability This standard contract language supports all Center for Clinical Standards and Quality (CCSQ) Programs, with contract types broken into two categories. When necessary, the CMS Business Owner (BO) and the Information Systems Security Officer (ISSO) will determine whether the entire contract or order (hereafter referred to as the “contract”), or a portion thereof, includes either or both of the following contract types:

1. General CMS Security & Privacy Policies: this contract type refers to all CCSQ contracts, and thus includes an overview of general security requirements. Regardless of the contract size, program objectives, funding, or other factors, all contractors are subjected to the applicable Department of Health and Human Services (HHS) and CMS policies stated herein.

2. IT Management and IT System Development: IT contracts may require the management of information technology, system or application development, or data management solutions. This contract type refers to systems that store, process, and/or transmit CMS data, and require additional safeguarding under FISMA, CMS Chief Information Officer (CIO) approved Authority to Operate (ATO), and continuous authorization efforts.

The following sections provide additional detail about the requirements associated with each contract type.

General CMS Security & Privacy Policies This section provides an overview of general CMS Security policies and outlines requirements applicable to all CMS contractors, subcontractors, and contract types. The CMS Information Security and Privacy Program website provides additional details of CMS security policies and procedures across CMS, and is referenced throughout this document.

The Contractor must adhere to all CMS and federal IT Security and Privacy standards, policies, statutes, and reporting requirements, as well as all National Institute of Standards and Technology (NIST) standards and guidelines, and other Government-wide laws and regulations for the protection and security of Government Information.

The Contractor must also adhere to the guidance and requirements provided within the CMS Information Systems Security and Privacy Policy (IS2P2). The IS2P2 consolidates existing information security and privacy policy documents into a single volume and directly integrates the enforcement of information security and privacy through the CMS CIO, Chief Information Security Officer, and Senior Official for Privacy.

The IS2P2 and other relevant documents can be obtained from the CMS Information Security and Privacy Library. The Contractor must review the CMS Information Security and Privacy Program website and Information Security and Privacy Library at minimum every 30 calendar days for updates.

The Contractor must ensure all applicable federal privacy requirements are being met, including, but not limited to, Privacy Act System of Records Notification (SORN), Privacy Impact Assessments (PIAs), Data Use Agreements (DUAs), and Computer Matching Agreements (CMAs) in accordance with CMS procedures available on the CMS Information Security and Privacy Library. The sections that follow provide detail on additional requirements of the General contract type.

Data & Records Management The Contractor assumes responsibility for protection of the confidentiality of government records and must ensure that all work performed by its employees and subcontractors is under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any CMS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

For security purposes, information may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor must protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

The Contractor must perform the following activities to ensure that any information generated, collected, or provided to the Contractor is properly maintained:

1. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to, and use of, information.

2. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information (available on the CMS Information Security and Privacy Library). Encrypt all sensitive federal data and information (including, but not limited to, Personally Identifiable Information (PII), Protected Health Information (PHI), proprietary information, and Federal Tax Information (FTI)) in transit (i.e., via email, network connections, etc.) and at rest (i.e., on servers, storage devices, mobile devices, backup media, etc.) with a FIPS 140-2 validated encryption solution.

3. Secure all devices (including, but not limited to, desktops, laptops, and mobile devices) that store and process…