Attachment A-Statement of Work_7R60221R00007.pdf

HEALTH RESOURCES AND SERVICES

ADMINISTRATION

ELECTRONIC HANDBOOKS (EHBS)

ATTACHMENT A

Statement of Work (SOW)

For Electronic Handbooks (EHBs)

March 5, 2021

TABLE OF CONTENTS

I. PROJECT TITLE

II. BACKGROUND

III. ELECTRONIC HANDBOOKS SYSTEM OVERVIEW

1 Background

2 Functionality

3 User Communities

4 Capabilities

5 Technology

6 Infrastructure

7 Program Governance

IV. SCOPE

V. PURPOSE

VI. TASK AREAS

Domain One and Domain Two (Common Task Areas)

1 Task Area 1 – EHBs Project Management

1.1 Single Point of Contact

1.2 Kickoff Meeting

1.3 Weekly Meetings

1.4 Technical Meetings

1.5 Project Management and Reporting

1.6 Capital Planning and Investment Control and Earned Value Management

1.7 HRSA Enterprise Project Life Cycle (EPLC) Management

1.8 Collaboration and Communication

Task Area 1 - EHBs Development, Modernization, and Enhancement (DME) Services

1.1 Conduct Requirements Gathering

1.2 Perform EHBs System Development

1.3 Conduct Product Verification Tests and Support V&V Testing

1.4 Provide Production Release and Post Production Release Support

1.5 45-Day Production Deployment Software Support Service

1.6 Provide Help, Training, and Adoption Support

1.7 Develop Comprehensive Documentation

1.8 Build/Update backlogs and Roadmap

1.9 Build/Maintain Development and Sandbox (SBX) test environments set up in cloud

2 Task Area 2 – EHBs Cloud Platform and Product(s) Integration/Migration and Re-factoring Specified EHBs Services and components

3 Task Area 3 – EHBs Data Analytics, Reports and Dashboards

4 Task Area 4 – EHBs Optimization, Innovation and Growth

5 Task Area 5 - EHBs DME Support Services Transition

5.1 EHBs DME Support Services Transition-In

5.2 EHBs DME Support Services Transition-Out

1 Task Area 1 - EHBs Systems Architecture Services

2 Task Area 2 - EHBs PMO Governance and Support

3 Task Area 3 - EHBs SA/PMO Support Services Transition

3.1 EHBs SA/PMO Support Services Transition-In

3.2 EHBs SA/PMO Support Services Transition-Out

4 Task Area 4 – HRSA Security and Records Management Requirements

4.1 Baseline Security Requirements

5 Task Area 5 – HHS Privacy

6 Task Area 6 – Federal Records Management & Retention

VII. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

SAMPLE LIST OF SCHEDULE OF DELIVERABLES

STATEMENT OF WORK

I. PROJECT TITLE

Electronic Handbooks (EHBs) – Domain One - Development, Modernization, and Enhancements (DME) Support Services, and Domain Two - Systems Architecture (SA) and Program/Project Management Office (PMO) Governance and Support

II. BACKGROUND

The Health Resources and Services Administration (HRSA) is an agency of the U.S. Department of Health and Human Services (HHS) whose mission is to improve health and achieve health equity through access to quality services, a skilled health workforce and innovative programs. HRSA assures the availability of quality health care to low income, uninsured, isolated, vulnerable and special needs populations. As the world’s leading public health agency, HRSA has the responsibility for promoting health and quality of life by preventing and controlling disease, injury and disability.

HRSA works with States, local public health agencies and partners throughout the Nation and the world to accomplish this mission. HRSA serves as the national focus for developing and applying disease prevention and control methodologies, environmental health strategies, and health promotion and education activities designed to improve the health of the people of the United States and throughout the world.

HRSA operates more than 90 plus programs and awards nearly $11 billion dollars in Federal grants on an annual basis to approximately 6,000 partner organizations. HRSA grantees provide health care to uninsured people, people living with Human Immunodeficiency Virus/Acquired Immunodeficiency Syndrome (HIV/AIDS), pregnant women, mothers, and children. They train health professionals and improve systems of care in rural communities. Tens of millions of Americans get affordable health care and other help through HRSA's programs.

HRSA relies on the EHBs System to assist with managing HRSA’s program administration needs, reporting performance of HRSA funded programs, sharing data within the organization, and improving business workflow. The EHBs facilitate the selection of appropriate grantees, monitoring of on-going progress, and the dissemination of program results contributing to meeting HRSA’s strategic goals and objectives.

The Division of Enterprise Solutions and Applications Management (DESAM) within the Office of Information Technology (OIT) is responsible for the overall operations, governance and management of the EHBs System. The following Bureaus/Offices (B/Os) are primary stakeholders of the EHBs:

• Bureau of Health Workforce (BHW) – BHW administers programs that are designed to strengthen the health workforce and connect skilled professionals to rural, urban, and tribal underserved communities nationwide.

• Bureau of Primary Health Care (BPHC) – BPHC oversees the Health Center Program, a national network of health centers that provide comprehensive primary health care services to more than 24 million people nationwide, regardless of a patients' ability to pay, charging for services on a sliding fee scale.

• HIV/AIDS Bureau (HAB) – HAB administers the Ryan White HIV/AIDS Program, which provides a comprehensive system of care for people living with HIV. The Program works with cities, states, and local community-based organizations to provide HIV care and treatment services to more than half a million people each year.

• Healthcare Systems Bureau (HSB) – HSB encompasses a diverse set of programs focused on protecting the public health and improving the health of individuals, including:

solid organ, bone marrow, and cord blood transplantation; Hansen’s disease direct patient care, provider education, and research; and the 340B Drug Pricing Program.

• Maternal and Child Health Bureau (MCHB) – MCHB programs serve more than 50 million women, children and families each year, including half of all pregnant women and one-third of all infants and children in the United States.

• Office of Federal Assistance Management (OFAM) – OFAM provides assurance of the financial integrity of HRSA's grant programs, and oversees HRSA grant activities to ensure they are managed in an efficient and effective manner.

• Office of Regional Operations (ORO) – ORO provides regional, state and community training and technical assistance through HRSA's ten regional offices.

• Federal of Office of Rural Health Policy (FORHP) – FORHP provides policy support to the Office of Secretary and supports a number of rural health programs, including rural health networks, black lung clinics, telehealth, and veterans’ rural health access programs.

• Office of Global Health (OGH) – OGH provides leadership, coordination, and advancement of global health programs relating to sustainable health systems for vulnerable and at-risk populations in collaboration with HHS Office of Global Affairs, other agencies, international organizations, and partners.

Other offices within HRSA such as the Office of Planning, Analysis and Evaluation and Office of Legislation also use the EHBs to support their operations.

III. ELECTRONIC HANDBOOKS SYSTEM OVERVIEW

1 Background

The HRSA Electronic Handbooks is HRSA’s mission critical investment supporting its grants and program management operations. It allows HRSA to operate in a paperless fashion, with improved business efficiency, and in compliance with mandated Agency-wide and Federal policies, procedures, and legislation. The system initially deployed in 2003 and has grown significantly over the past 18 years. Today it provides end-to-end support for HRSA’s programs starting from planning through to post award performance reporting and closeout. In 2020, the EHBs helped the agency in administering $12.38B in grant dollars through 33,000 award actions. HRSA received more than 48,000 post award electronic submissions from its 6,500 active grantees. HRSA’s grants and program staff completed more than 448,000 tasks and recorded more than 691,000 correspondence emails items in support of grants processing and oversight.

2 Functionality

The EHBs provide support for enterprise-wide grants and program management life cycle. It encompasses nearly all of the grants processes starting from forecasting, planning, application, review, pre-award, award, post-award monitoring, technical assistance, and closeout. It supports HRSA’s grants, loans, and benefits portfolio (Federal Tort Claims Act [FTCA] and Federally Qualified Health Centers-Look Alikes [FQHC-LAL]). Majority of the bureaus and offices use standard or tailored capabilities and have program specific capabilities to collect performance/progress data on grant awards. The EHBs interoperates to leverage functionality that is available through other federal IT systems. For example, HRSA uses Grants.gov to publish grant award announcement and receive competitive applications. Applications are reviewed in the EHBs and peer review is conducted in HHS’ Center of Excellence (COE) Grant Solutions system.

Selection and funding decisions are made in the EHBs. To obligate awarded funds and perform Congressional and other financial reporting, EHBs utilizes COE. The EHBs system also utilizes System for Award Management (SAM) to validate the registration of all external organizations that interact with HRSA’s grant process. It supports various functions for completing post-award reporting requirements, project officer oversight and monitoring, and aids with conducting in-depth analysis of program grant allocation, use, and effectiveness.

The EHBs system offers program and grants staff access to data through standard and ad hoc self-service data sets. The EHBs system maintains all official files for programs, applications, organizations, and grants. It includes a suite of administrative tools to provision programs and users.

3 User Communities

Attachment A1 – HRSA EHBs Functionality provides an overview of the core functions and Bureau/Office specific functions across the grant lifecycle.

Attachment A2 – HRSA EHBs Transactions provides statistics by grant lifecycle phase.

Attachment A3 – Enterprise EHBs User Roles provides details on the current roles.

The EHBs system supports more than 1,800 internal users and more than 43,000 active external users. There are four user communities within the EHBs:

• Internal users: HRSA staff and Contractors supporting the grants lifecycle

• External users: Applicant and grantee organization users

• Technical Assistance users: Consultants providing technical assistance expertise

• Other users: Fiscal, audit intermediaries, and providers who participate in certain parts of the grants lifecycle for specific programs

HRSA uses the COE for grant application reviews, so the reviewers do not access the EHBs.

Users get access to the system based on their roles. Different registration and provisioning models are available for internal and external users.

4 Capabilities

The EHBs capabilities are divided into four distinct categories:

Core Modules: The core modules provide enterprise-wide support for the entire grants lifecycle.

This includes planning, application, review, selection, award, post-award, and closeout. The EHBs system allows different programs to tailor the lifecycle based on a combination of configuration and customization options such as those based on the type of programs and funding method (such as formula, discretionary, research, training, or service delivery) or nature of the application (new, follow-on, or amendment). The system supports different workflows or roles (e.g.; terms and conditions) based on the set up. When enterprise capabilities do not meet a program-specific need, they have the ability to customize and integrate using the existing toolkits and common business services such as the grant folder.

Bureau/Program Specific Modules: Bureaus/Offices have their own modules either to support program-specific customizations (ex. health center program has a program specific application and review capability) or their specific business operations (ex. the Division of Financial Integrity has a financial assessment capability). Major programs have their customized performance reporting capabilities that provide deep and rich data reporting, review, and analytical capabilities using different performance reporting system modules. All Bureaus/Offices (BHW, BPHC, FORHP, HAB, OGH, OFAM, and MCHB) have modules that serve their specific needs, but all of them are

Attachment A4 – EHBs Modules provides a list of capabilities and the products that enable them.

Attachment A4.1 through AttachmentA4.5 – Bureau Reporting Sub Systems provides a list of all the performance- reporting modules.

Attachment A5 – EHBs External Interfaces provides a list of external interfaces to the system.

integrated by the enterprise grants life cycle providing a single view of an organization to HRSA and vice-versa. The EHBs also support non-grant programs such as Loans, FQHC-LAL, and the FTCA programs for health centers and free clinics.

Support Modules: The EHBs includes several supporting modules such as the internal and external portals, search, grant folders, reporting and dashboards capabilities, administrative modules, notes, emails, issues tracking, document management, training, outlook plug-in, and help modules. The support modules bring all business functionality together and provide internal and external users a unified view of the entire system.

Integration Services: The EHBs integrates with multiple external systems such as Grants.gov, SAM.GOV, Payment Management System (PMS), Unified Financial Management System (UFMS), GrantSolutions.gov (Application Review Module [ARM] and Grants Review Module [GRM]), GovDelivery, and internal systems such as HRSA Data Warehouse (HDW) and Integrated Resource Management System (IRMS). The EHBs platform exposes web services that allow EHBs modules and program specific modules to exchange information without creating tight coupling. Each module is responsible for maintaining boundaries that provide access to relevant operations within its context.

Each module may have one or more products that enable its functionality. A product is defined as an independently packaged capability. The following attachments provide more information:

5 Technology

The HRSA EHBs have primarily been architected and developed on the Microsoft platform. The system runs on Windows 2012, 2014 and 2016 OS and Linux7.6, Microsoft Internet Information Services (IIS) 8.5 Web Server, Apache TOMCAT and SQL Server 2012/2014 and 2017. The individual applications use ASP.NET v3.5, v4.5 and .NET CORE. Any unstructured data is stored on a file server. The current architecture includes support for two different versions of a Government-owned platform that is shared across multiple applications. The shared platform provides common technical micro services and frameworks to maintain a consistent user interface.

The current database size is ~1.38 TB and the size of unstructured data is ~ 7 TB. Recent advancements in the technical architecture include a new mobile enabled platform; Redis cache platform to leverage static data cache at Enterprise level; ChatBot to help answer common questions using Teneo AI/ML platform; incorporation of Tableau for external and internal facing dashboards;

Splunk for Enterprise Monitoring; Jenkins, Octopus, DbUp, Nexus, and Git for CI/CD integration;

Attachment A6 – EHBs Core Architecture provides a snapshot of the current architecture Attachment A7 – EHBs Core Architecture provides a snapshot of tools and technologies.

Seeker, Coverity and Blackduck for Security scanning; Selenium for automated test; JMeter, Load runner for performance testing; and integration with Microsoft Dynamics 365 SaaS platform for NOFO Processing. Currently, the system has more than 460 enterprise reports and more than 2,600 ad hoc reports.

6 Infrastructure

The system is hosted in a data center in Sterling Data Center, Ashburn, VA on Government furnished hardware and software. The data center contains production and non-production environments. A back up data center exists in the HRSA Parklawn Data Center, Rockville, MD.

The development environments and tools are provided by the individual Contractors. The government provides remote access to the required HRSA environments for DME activities.

Currently, the production system runs on a web farm that includes 60 plus virtual servers and services with an average of 43 M requests/year and average response time of less than three (3) seconds.

The non-production environments include integration UAT, test harness, security testing, staging, training, and post production support. The operating model for environments at HRSA is being refreshed to adopt best practices from the industry to bridge the hand offs between multiple vendors support for Development, Modernization, and Enhancement (DME) services under previous contract it was referred to as Systems Development Services (SDS), Enterprise Architecture (EA)/Program Management Office (PMO), Operations & Maintenance (O&M), and Verification & Validation (V&V) Support services.

7 Program Governance

OIT/DESAM operates the HRSA EHBs PMO which is responsible for investment governance, contract management, technical direction and oversight, business liaison, Systems Architecture (SA)/PMO, SDS/DME, O&M, and support. DESAM works collaboratively with other divisions within OIT that are responsible for the infrastructure and enterprise architecture and capital planning and investment control.

The EHBs governances includes an Enterprise Governance Board and Steering Committee responsible for coordinated investment decisions, a Stakeholder Group responsible for bi-directional

Attachment A8 – HRSA EPLC Framework provides a software development framework.

Attachment A9 – EHBs Quality Metrics provides a summary of the focused quality areas and related metrics.

Attachment A10 – EHBs SonarQube provides a summary of the measured baseline metrics.

communication, and Business Owners from different Bureaus/Offices responsible for the business requirements and processes.

In FY 2016, HRSA consolidated multiple O&M efforts into a single consolidated enterprise O&M contract with separation of duties from other Contractors providing other services such as DME, EA and V&V in support of the EHBs. HRSA intends to maintain this separation to gain cost efficiencies and quality benefits from industry best practices.

EHBs software adopts the HRSA Enterprise Performance Life Cycle (EPLC) framework to ensure alignment with HRSA's Enterprise Architecture (EA), HRSA's Capital Planning and Investment Control (CPIC), and the Health and Human Services (HHS) EPLC along with other applicable Departmental guidelines and Federal directives. In addition, the EHBs program uses quality metrics and the SonarQube software tool to baseline and continuously improve the EHBs program deliverables and the code quality. The following attachments provide more information:

IV. SCOPE

The scope for two domains are included in this Statement of Work (SOW). For Domain One, the Contractor shall provide DME services for the EHBs to meet the mission of HRSA’s Bureaus and Offices and for Domain Two, the Contractor shall provide SA/PMO services. There are tasks areas in this SOW that are common to both domains/vendors (e.g., security, records management, etc.)

that both contractors shall address in their proposals. In addition, there are domain specific tasks that are unique to each domain/contractor.

The overall scope of this SOW covers all EHBs systems and sub-systems, as described in the EHBs Overview Section in this document and includes any additional EHBs systems and sub-systems that are added throughout the duration of this IDIQ. Specifically, the services shall cover all phases of the Software Development Lifecycle (SDLC), including requirements gathering and analysis, solution design and development, unit and functional testing, integration testing, supporting Verification and Validation Test services, deployment, integration, and documentation.

Separate task orders will be issued under the Domain One and Domain Two. The following describes the typical tasks which may be required of the contractor in the performance of task orders awarded. The task orders will not necessarily contain the entire task areas listed below, but shall specify the actual tasks to be performed along with the project-specific information required for completion of the task order.

The DME and SA/PMO Contractors shall collaborate with each other and the other EHBs vendors, and HRSA to provide services in the following major task areas under this IDIQ:

Domain One and Domain Two (Common Tasks)

• Common Task Area 1 – EHBs Project Management

• Common Task Area 2 – HRSA Security and Records Management Requirements

• Common Task Area 3 – HHS Privacy

• Common Task Area 4 – Federal Records Management & Retention

Domain One

• Domain One Task Area 1 – EHBs Development, Modernization, and Enhancements (DME) Services

• Domain One Task Area 2 – EHBs Migration to Cloud and Re-factoring EHBs Services and Components

• Domain One Task Area 3 – EHBs Data Analytics and Dashboards

• Domain One Task Area 4 – EHBs Optimization, Innovation and Growth

• Domain One Task Area 5 – EHBs DME Support Services Transition

Domain Two

• Domain Two Task Area 1 – EHBs Systems Architecture Services

• Domain Two Task Area 2 – EHBs PMO Governance and Support

• Domain Two Task Area 3 – EHBs SA/PMO Support Services Transition

V. PURPOSE

The purpose of this contract is to provide DME and SA/PMO support under two different domains for HRSA’s EHBs systems. These services will enable HRSA to better utilize the EHBs investment in response to various legislative, policy, management, and technology changes.

Individual task orders may be awarded on a cost reimbursement, firm fixed price, labor hours, and time and material basis. Task orders will be fully funded and/or contain options.

VI. TASK AREAS

Domain One and Domain Two (Common Task Areas)

1 Task Area 1 – EHBs Project Management

This task area enables HRSA to ensure that the necessary contractual, program management and quality assurance goals, and administrative and security compliance requirements are met. It includes master contractual reporting requirements and expectations, Contractor’s overall program management plan for the IDIQ, HHS Enterprise Performance Life Cycle (EPLC) requirements, Earned Value Management (EVM), Capital Planning and Investment Control (CPIC) requirements, and evolving Security mandates.

The Contractor shall:

1.1 Single Point of Contact

Provide a single point of contact for the management of all aspects of this contract to the Contracting Officer’s Representative (COR). The point of contact shall be responsible for ensuring that the services and deliverables required by HRSA are provided in accordance with the Task Order.

1.2 Kickoff Meeting

Meet with the COR and other HRSA representatives at the Parklawn Building, 5600 Fishers Lane, Rockville, MD within five (5) business days of the EDOC to discuss all current activities and the scope of work. Two (2) business days prior to the kickoff meeting, provide an agenda for the meeting. At the kickoff meeting, provide a draft project management plan and timeline, updated roster of key personnel, and proposed communication schedule.

1.3 Weekly Meetings

Meet weekly with the Technical Manager and/or COR and other stakeholders to discuss project updates and critical issues to be resolved. Notify the COR within one (1) business day, if issues arise that prevent the Contractor from attending a meeting. Notify the COR within three (3) business days of any event which will create a delay in the schedule and/or result in additional cost to HRSA.

All notifications shall be submitted electronically to the COR in writing and shall document the reason for the delay, the status of the budget, the impact on the project, and the action the Contractor is taking to bring the project back on schedule.

1.4 Technical Meetings

Participate in or facilitate meetings, conference calls and/or workgroups with HRSA Program staff and EHBs stakeholders. Within three (3) business days of the meeting, develop and provide brief, summarized minutes after meetings that: identify the attendees, summarize the meeting, and document all action items.

1.5 Project Management and Reporting

A. Monthly Status Report. Provide a Monthly Status Report for each monthly reporting period, due on or before the 5th business day after the end of the reporting period. This monthly report shall cover all EHBs systems/modules covered by this agreement. This report shall contain the following sections:

1. Project description,

2. Activities planned for the upcoming reporting period,

3. Activities performed during the prior reporting period,

4. Accomplishment Summary for past month

5. Progress on deliverables as stated in the Project Management Plan,

6. CPIC/EVM Report,

7. Project issues and risks that may impact schedule, budget, and/or quality,

8. Details of the resources used, total hours, and total dollars expended at the project level during the reporting period on V&V activities for all program specific modules,

9. Any other B/O specific requirements (i.e., quarterly reporting, annual reporting, various module updates, etc.), and

10. Customer Compliments and Complaints Report.

B. Quarterly Status Report. Provide a Quarterly Status Report for each reporting period, due on or before the 7th business day after the end of the quarterly reporting period. This quarterly report shall cover the following:

1. Updated System Roadmap with Technology, automation and business process re-engineering.

2. Quarterly accomplishment report summarizing high level achievements across the program and all Task Orders.

C. Final Report. The final report shall include all previously delivered documents (Monthly Reports, Release Reports, Testing Reports, Operations Manual, User Manual, etc.), templates and any meeting material or presentation slide decks, as well as any incorporated corrections/clarifications based on comments and questions provided by the Government during meetings and presentations. The final deliverable is due no later than ten (10) business days before the end of the period of performance.

1.6 Capital Planning and Investment Control and Earned Value Management

Capital Planning and Investment. Support progress reporting for the HRSA CPIC process

– including detailed monthly invoicing including labor costs (i.e., hours/staff (rates)/task), other direct and indirect costs, and fees.

Earned Value Management. Track cost, schedule and scope through EVM reports for all projects. This information shall be included in the Monthly Status Report.

1. Apply and manage tasks in accordance with HRSA’s EVM policy. Incorporate an EVM

System throughout the full IDIQ life-cycle.

2. Use Microsoft Project or equivalent HRSA-approved software to provide project status information at WBS level 3, with capability to report at any lower level at the request of the COR.

3. The EVM Monthly Status reports shall contain the following information:

• Budgeted (planned) Cost for Work scheduled (BCWS) = Planned Value

• Budgeted Cost for Work Performed (BCWP) = Earned Value

• Actual Cost of Work Performed (ACWP) = Actual Cost

• Budget at Completion (BAC)

• Estimate at Completion (EAC), and

• Performance curve graph plotting cumulative BCWS, BCWP, and ACWP on a monthly basis from inception of the agreement, with BCWS plotted to completion and projecting the ACWP curve to the Estimate at Completion (EAC) value. (Data will be extracted from MS Project and plotted in MS Excel.)

• EVMs variance analysis:

o Cost Variance = (BCWP - ACWP);

o Cost Variance % = (CV / BCWP x 100%);

o Cost Performance Index (CPI) = (BCWP / ACWP) o Schedule Variance = (BCWP - BCWS);

o Schedule Variance % = (SV / BCWS x 100%);

o Schedule Performance Index (SPI) = (BCWP / BCWS);

o Explain the reasons for all variances that exceed the statutory threshold of 20 percent or a lower threshold specified in the IDIQ.

o Define technical performance variance. Explain, based on work accomplished as of the date of the report, whether the performance goals will be achieved, and the impact to the cost and schedule goals.

The quarterly EVM reports are summarizations of the monthly reports.

1.7 HRSA Enterprise Project Life Cycle (EPLC) Management

All EHBs software development/modernization/enhancements work shall follow the HHS/HRSA Enterprise Project Life Cycle (EPLC) software development framework (See Attachment A8).

HRSA EPLC templates shall be used for all development project documentation when available.

This task covers activities across the project lifecycle such as usability studies, requirements analysis, design, development, and implementation.

1. Perform integrated project management following HRSA EPLC policies, procedures, and processes.

2. Prepare comprehensive documentation supporting applicable activities that are 508 compliant.

This includes preparing a design and implementation document, maintaining data models, maintaining business rules documents, preparing testing plans and recording results, as well as all code developed for the system. Table 8 outlines a sample list of EPLC deliverables. The Project Process Agreement (PPA) will be provided at kick-off to tailor the EPLC requirements in terms of justifications for selection, substitution or omission of specific reviews, deliverables, and other EPLC components relevant to this project.

3. Support applicable stage gate reviews, which includes providing EPLC artifacts and documentation of the project life cycle to the COR three (3) business days prior to a stage gate review meeting being held. This also includes, mitigating all issues that arise through the User Acceptance Testing (UAT), security scans, etc. that could result in a delay.

4. Follow standard process and procedures established at the Enterprise level by OIT such as utilizing Single ALM, documenting user stories at HRSA repository, use HRSA owned ALM and ticketing system for requirement traceability, when possible utilize HRSA owned environments for UAT, performance testing and release process, security scans using all HRSA approved tools, and code quality platform to maintain the industry standard baseline, as per OIT’s recommendation etc.

5. For all software tested at HRSA, provide performance benchmark/quality reports such as page load of 3-4 seconds, database query and ETLs per the baseline, number of 400/500 error reports using HRSA’s alerting and monitoring platform for project sign off from stakeholders before ten (10) days of software release date.

6. Provide release quality metrics before and after each release. Release quality metrics include Requirement quality, Meeting Quality, UAT Quality, Release Quality, and post release quality.

(See Attachment A9 for template).

1.8 Collaboration and Communication

Collaborate and cooperate with the other Contractors in the HRSA environment to foster a seamless, team-oriented environment. Be part of a multi-vendor environment promoting the success, adoption and availability of EHBs that includes HRSA employees from various business units and other Contractors. Work effectively across internal HRSA organizational boundaries and external organizational boundaries.

DOMAIN ONE

Task Area 1 - EHBs Development, Modernization, and Enhancement (DME) Services

This task area enables HRSA to seek systems development services for business enhancements of HRSA’s EHBs system and related Bureau/Office sub-systems. It includes capturing business requirements gathering, performing solution design and development, conduct testing on their own and in collaboration with Verification & Validation (V&V), Operations and Maintenance (O&M) Contractors, providing production release and postproduction release support, training and system documentation.

The contractor shall complete the following tasks consistent with requirements of HRSA’s EPLC, EHBs PMO practices, HRSA EHBs governance model, HRSA EHBs systems architecture using a combination of SDLC methodologies such as Scaled Agile Framework (SAFe), Program Incremental (PI) Planning, Lean Management methods, Iterative, and Waterfall as defined in the specific Task Order. Use state-of-art application lifecycle management (ALM) tools, methodologies and techniques to support continuous delivery. The services performed in this contract shall be integrated with work being performed by EHBs Systems Architecture & PMO Support Services, O&M and EHB V&V vendors. Ensure that all the software and work products delivered under this task are 508 compliant.

1.1 Conduct Requirements Gathering

The Contractor shall:

1. Gather, review and interpret System Requirements.

2. Develop and maintain a requirements traceability matrix throughout the project lifecycle and create Epic and user stories in HRSA owned repositories such as confluence and Team Foundation Server (TFS) to link them with JIRA enhancement tickets.

3. Create and prioritize system requirements by meeting with project stakeholders and capturing their needs.

4. Develop presentation slides and one pager describing objective, what is expected outcome from the meeting 3 business days prior to the actual meeting and measure the meeting quality as per the guidance from OIT (See Attachment A9) and report back the quality metrics.

5. Identify business gaps and develop business process re-engineering methods to improve the efficiency.

6. Perform requirements analysis by creating mockups and/or wireframes for use in design and development.

7. Perform review sessions with project stakeholders to ensure the accuracy of the requirements.

8. Work closely with system owner throughout the system development life cycle to ensure the approved requirements are implemented correctly and accepted.

9. Perform systems review to understand systems environment and requirements related to technical issues.

10. For each development project, adhere to Section 508 Compliance guidelines, and Software

Development Project Management EPLC.

11. Prepare comprehensive mock-ups and necessary documentation to depict the various data elements, process flows, business rules and other requirements, and get them reviewed and approved.

12. Provide subject matter expertise for relevant product suite including applicable coding languages.

13. Provide comprehensive documentation and information necessary to analyze processes, procedures, and/or policies that were implemented in the creation of the applications.

14. Conduct Knowledge Transfer of the business requirements for the O&M, EA and V&V vendors upon signoff.

1.2 Perform EHBs System Development

1. Perform DAR and conduct POC before implementing new technology at the Enterprise level.

2. Develop architectural and process diagrams and get required approval from OIT Architecture, HRSA architecture, EHBs COE, EA and O&M teams to finalize the design.

3. Create and maintain the detailed technical design document for each product including data model and data dictionary and store in HRSA owned tools such as confluence, JIRA and SharePoint.

4. Develop the software based on the approved requirements to perform business enhancements.

5. Implement the modern architecture and technologies using the approved designs and proof of concepts provided by OIT.

6. Over the life of the contract, implement 100 % automated unit test for all software modules and releases including legacy modules as they are developed under separate Task Orders (capture % Automated in the quarterly accomplishment across Task Orders).

7. Reduce technical debts for all the legacy and modern modules release by release. Performance will be evaluated based on the % of reduction. Use SonarQube and Splunk platform to generate the report for each release.

8. Maintain the release quality standards by providing metrics such as # of 400 / 500 errors, Page load in 3 second as standard threshold, # of code sync after due date, etc.

9. Use Scaled Agile framework for system development and conduct sprint demo to stakeholders.

10. Over the life of the contract, develop and execute a plan for maintaining a maximum of 2 versions of the latest common components and third party tools/technologies to eliminate the security vulnerabilities and address the End of Life support with each major and minor releases.

11. Perform all steps necessary in the system or product development life cycle.

12. Perform unit testing to ensure the system functions as per the defined requirements.

13. Implement the release management automation using continuous delivery principles.

14. Provide high quality documentation for each Stage Gate review to the COR five (5) business days prior to the review meeting.

1.3 Conduct Product Verification Tests and Support V&V Testing

1. Conduct the necessary testing on the software changes and provide support to the V&V vendor to complete all aspects of testing and address all software defects.

2. Perform unit testing and security testing in a development sandbox environment.

3. Conduct functional testing using the approved test scenarios.

4. Automate 20 -25 % of functional, and regression tests year by year as part of each release under Task Orders and integrate the test scripts with EHBs test harness platform without impacting the system development cost.

5. Automate UAT/Functional test data generation process by utilizing existing Training data creation framework, Data Generation tools approved by HRSA and Test Harness Framework for each release.

6. Perform security testing on all approved software changes and ensure no vulnerabilities exist in accordance to the security requirements section.

7. Perform integration testing on the HRSA provided environments for the approved projects specified in the Task Order.

8. Conduct performance testing on a scaled performance test environment provided by HRSA for each major and minor releases to ensure the performance quality standards are met. Conduct the test with minimum of 500 concurrent users and maximum defined by OIT. Ensure that the tests demonstrate the new system produces results that meet or exceed those produced by the current EHBs processing system when using identical input transactions.

9. Perform Section 508 Compliance testing of the EHBs application (modules) using the standards/criteria in accordance to the Section 508 requirements.

10. Provide the traceability matrix to trace all requirements using TFS and other tools.

11. Support in providing access to the test environment for all EHBs vendors to perform UAT, Performance and Integration testing.

12. Support all EHBs vendors to test the dependency of changes within or across different HRSA

EHBs modules and products on HRSA owned non production environments.

13. Support all EHBs vendors to test the performance of the system in a performance test environment using industry standard tools such as Tabjolt, LoadRunner, and Jmeter. Address any gaps and ensure that the performance of the newly enhanced system meets or exceeds that baseline.

14. Support all EHBs vendors to perform regression testing on all approved software changes to be deployed into production.

15. Record defects/issues in HRSA JIRA and review the results of unit, functional, and Section 508 testing with EHBs PMO and all EHBs vendors.

1.4 Provide Production Release and Post Production Release Support

1. Provide production and post production release support to successfully deploy the software changes on EHBs production system.

2. Develop/update/improve build scripts, configuration variables and packages and support the deployment of the software in all environments including production environments by collaborating with EHBs O&M, V&V and EA vendors.

3. Enhance the DevSecOps pipeline to follow all the standards and processes approved by HRSA.

4. Automate post production verification for all the releases to minimize the manual efforts and increase efficiencies year by year.

5. Address any defects resulting from the deployment within 45 days of deployment at no additional cost to HRSA. Get the sign off on the start date of 45 day warranty from stakeholders prior to release, in some cases the 45 days period can start later than the deployment/release date depending upon the projected usage. Project planning at the Task Order level shall account for accommodating the projected 45 day warranty days within the performance period.

1.5 45-Day Production Deployment Software Support Service

1. Address any defects resulting from the software deployment within 45 days of deployment at no additional cost to HRSA.

2. Get the sign off on the start date of 45 day warranty from stakeholders prior to release, in some cases the 45 days period can start later than the deployment/release date depending upon the projected usage.

• Project planning at the Task Order level shall account for accommodating the projected 45 day warranty days within the performance period.

• All critical and high 45 day warranty defects should be fixed in 30 days of the reporting date and all low and medium defects in 45 days of the reporting date.

3. Apply the 45-Day EHBs Deployment Software Support Warranty service to deployed releases.

See Table 1 (45-Day Warranty) below:

Table 1: 45-Day Warranty

Release / 45 Day Warranty Findings From

Resolve the Findings from New

Code

Resolve the Findings from Legacy Code

Responsible Team

New Product / Module New Code only Yes Yes DME vendor

Existing Product / Module

New Code and reusing existing code that is modified for this release

Yes Yes DME Vendor

45 Day - In Warranty

New Code and reusing existing code that is modified for this release

Yes Yes DME Vendor

45 Day - In Warranty

Existing code that is not modified for this release, however an issue is identified during the testing cycle for this release

Yes Yes DME Vendor

45 Day - Out of Warranty

Any Code; Nature of the Issue, based on Action Plan & LOE

Yes Yes O&M Vendor/or DME Vendor

4. At a minimum, schedule deployed releases at least 45-days prior to the end of this contract’s performance period.

5. Support all releases in collaboration with the EHBs O&M Contractor.

6. For defect tickets escalated from the HRSA Customer Support Center /Tier II, the Contractor shall help determine whether the issue results from an application bug or from the operational environment. In cases where the defect results from an application bug, the Contractor shall fix and test the bug, and create a patch release. In cases where there are issues with the operational environment, the O&M Contractor is responsible for resolving. The following are the policies and guidelines to execute the 45-Day EHBs Deployment Software Support Warranty:

• Warranty shall end 45 calendar days of production release date or the date established by the stakeholders and negotiated with the COR. This shall include holidays and weekends.

The O&M Contractor then becomes responsible for supporting the release.

• Any defects identified in production within 45 days of the warranty period shall be logged into the EHBs JIRA system. The identified defects shall be scheduled for a patch release after the respective EHBs Program Management Office (PMO) service board’s approval.

• Any enhancements identified as part of User Acceptance Testing (UAT) shall be added to the release backlog. Those items shall not be part of the 45-day warranty period. Such items shall be prioritized by the EHBs PMO service board members separately.

• All DME releases including the patch releases scheduled within the 45-day support period shall be completed prior to the end of the Task Order’s period of performance.

• Any defect reported by business and/or end-users after 45 days of warranty period shall be addressed by the EHBs O&M Contractor.

• The EHBs DME Contractor shall participate in the service board meeting to triage and prioritize the defects.

• The DME Contractor shall furnish full documentation (i.e. EPLC stage gate documents) of all changes and/or modifications to the application software and work with the EHBs O&M Contractor to release the changes into production.

• DME Contractor shall notify COR and the EHBs O&M Contractor once the 45-day warranty period of the release is completed.

1.6 Provide Help, Training, and Adoption Support

1. Ensure that the EHBs customer support staff is provided proper training for their use of the developed system components.

• Project Officers, EHBs customer support, vendors and analysts shall be trained to use the new functionality using in class instruction or web-based training forums or self-paced online material.

• Training material shall be made available online to ensure access and use. Training shall be designed with an emphasis on how the system functionality applies to the business as well as a user manual.

2. Develop/update system help and videos for major system enhancements or new features.

3. Enhance EHBs wiki help system to organize the content by roles and business functions to increase the help system adoption. Develop a roadmap to release the enhanced system and related changes iteratively.

4. Periodically review user feedback and provide plan for addressing the system navigation and usability issues.

5. Provide system adoption and process support to all users (HRSA staff, OIT support staff and vendor staff) for existing features and new features that are implemented.

6. Help train the EHBs Customer Support Center staff on system functionality, and provide documentation for the system changes. This training shall be by class instruction or via webinar.

The documentation shall be provided to the COR within two (2) weeks of the release.

7. Assist with system release communications to various stakeholders such as support staff and Stakeholders.

8. Identify opportunities for improving the software based on training, help requests, and feedback from users during adoption activities that will be incorporated into the requirements backlog for prioritization from HRSA.

1.7 Develop Comprehensive Documentation

1. Prepare 508 compliant comprehensive documentation supporting all activities as outlined in the deliverables section.

2. Prepare all the documentation required based on the Project Process Agreement (PPA) defined at each Task Order. A sample list of deliverables are specified in the deliverables section.

3. Prepare deployment documentation including installation documents and release notes and provide said documents to the COR.

4. Prepare necessary online help / videos for the system and associated system outreach materials for all release.

5. Provide incremental documentation through sprint cycles that result in full technical and end-user documentation or configuration for all software development efforts and product releases.

1.8 Build/Update backlogs and Roadmap

1. Develop/Update system/technology/business process re-engineering and automation

Roadmap by working with OIT leads, Systems Architecture, strategy innovation teams, and stakeholders on every quarter.

2. Create and maintain all enhancements requests in HRSA owned tools such as JIRA, TFS and SharePoint to build system backlogs for stakeholder review as part of regular project delivery execution.

3. Evaluate the enhancements, document the impact analysis and detailed estimate for implementing system changes on quarterly basis. Conduct the review session with all the stakeholders and EHBs vendors on a monthly basis.

1.9 Build/Maintain Development and Sandbox (SBX) test environments set up in cloud

1. Develop an optimized Architecture to support the development and SBX environment in cloud.

2. Create and manage optimized development and SBX environment in Azure cloud using a separate subscription, not integrated with vendor network.

3. Handover the environments to new vendor at the end of the period of performance of the contract. Transition all scripts and assets to new vendor when requested or during transition-out phase.

4. Provide access to other EHBs vendors to the environments if needed.

5. Re-use the automation script built by O&M vendor and other EHBs vendors to reduce the set up and configuration process of development and SBX environment.

6. Optimize the infrastructure, reduce # of environments, and reduce the resource usage to limit the overall cloud service and program overhead cost.

7. Conduct Knowledge sharing sessions to other vendors when requested.

2 Task Area 2 – EHBs Cloud Platform and Product(s) Integration/Migration and Re-factoring Specified EHBs Services and components

These activities may cover various forms of integration, refactoring, and/or migration using cloud platform and products including such as including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Database as a Service (DaaS), Infrastructure as Code (IaaC), etc. These activities shall be performed as the DME activities which include the requirements of the HRSA EPLC and Software Development Life Cycle (SDLC) best practices. The Contractor shall provide Level of Effort (LOE) on all related enhancements/modernizations as directed by the COR, Project Manager or Program Manager.

1. Develop and maintain a roadmap for migrating EHBs to cloud which includes Technology, business process re-engineering and automation.

2. Migrate all databases, services, tasks and applications in cloud PaaS services to achieve scalability, high availability and reliability.

3. Re-architect and re-factor all common services and components to cloud container or Web App services and integrate them with all business modules. Provide options for loosely coupled application and data architecture while refactoring the modules, data integrity has to be maintained until the migration is complete.

4. Migrate EHBs, BRS, TVIS and all sub-systems in an iterative approach for both data, file system, and application components.

5. Deprecate the legacy systems and develop/update all ATO controls required for cloud.

6. Modernize the EIS (EHBs Integration Service) to a micro service…