80TECH24Q0023 Attachment A Performance Work Statement (00003).pdf

Attachment A Performance Work Statement (00003)

Attachment A Performance Work Statement

For

Johnson Space Center (JSC) Electronic Health Record

(EHR) Replacement

PERFORMANCE WORK STATEMENT

JSC EHR REPLACEMENT

TABLE OF CONTENTS

Table of Contents

1.0 Introduction

1.1 Purpose

1.2 Overview

2.0 Background

2.1 Relevant Constituents

2.1.1 Flight Medicine

2.1.2 Lifetime Surveillance of Astronaut Health

2.1.3 Occupational Health

2.1.4 Behavioral Health

2.1.5 Employee Assistance

2.1.6 Neutral Buoyancy Lab (NBL)

2.1.7 Star City/Moscow (Russia)

2.1.8 Test Subject Screening (TSS)

2.1.9 White Sands Test Facility (WSTF)

2.2 Current Electronic Health Record

2.3 Unique Attributes

2.4 Unique Services

2.5 EHR Usage for Astronauts

2.6 Additional background information

3.0 Scope of Work

3.1 Technical Requirements

3.1.1 Data Management and Integration

3.1.2 Software Features and Capabilities

3.1.3 Customization and User Interface

3.1.4 Operational Support and Maintenance

3.1.5 Patient and Medical Data Handling

3.1.6 Access Controls

3.1.7 Clinical Documentation and Data Handling

3.1.8 Training

3.1.9 Integration

3.2 Additional Cloud Specific Implementation Requirements

3.2.1 Protection of Information

3.2.2 Confidentiality and Nondisclosure

3.2.3 Authorization of System

3.2.4 Reporting and Continuous Monitoring

3.2.5 Data Jurisdiction

3.2.6 FIPS 140-3 Validated Cryptography for Secure Communications

3.2.7 Audit Record Retention

3.2.8 FedRAMP

3.3 Schedule Requirements

3.3.1 Contractor Team

3.3.2 Project Initiation

3.3.3 Master Project Plan

3.3.4 Launch Functional System

4.0 Deliverables

4.1 Master Project Plan. See DRD for specifications

5.0 Travel

6.0 Government Furnished Equipment

7.0 Security, Safety, and Quality

7.1 Safety and Quality

8.0 Export/Import Control

9.0 Interface Table and Diagrams

10.0 Acronyms

11.0 Standards, Regulations & Compliance References

List of Figures Figure 1 – NASA JSC EHR Edge Location End-Points Diagram Figure 2 – NASA JSC EHR System Interfaces Diagram Figure 3 – NASA JSC EHR Device Interfaces Diagram

1.0 Introduction

1.1 Purpose

This document outlines the functional and technical requirements for the NASA JSC Electronic Health Record (EHR) Replacement Project. This document provides an understanding of the project scope, for successfully implementing the NASA JSC EHR.

1.2 Overview

The Human Health & Performance Directorate (HH&PD) at NASA is responsible for ensuring the health and productivity of humans during all phases of spaceflight. This includes providing flight and ground-based healthcare, occupational health, research, test subject screening, and support functions. The goal is to achieve NASA's mission objectives.

HH&PD collects, processes, stores, uses, and disseminates human subject health-related information to fulfill these functions. They use various data management products and services, including an EHR system, to support operational decision-making.

The purpose of the JSC Clinic is to recognize, evaluate, control, and mitigate illness and disease associated with the flight and institutional work environments and to ensure the health, productivity, and wellness of the JSC team members.

NASA intends to replace the current commercial-off-the-shelf (COTS) EHR system at JSC with a new COTS EHR solution. This Performance Work Statement (PWS) aims to identify and select a successful contractor to deliver an EHR solution that best matches the criteria and conditions specified.

The current EHR is installed primarily on-premises at Johnson Space Center in Houston, Texas, with limited cloud-based test environments and connectivity. Backup facilities are in White Sands, New Mexico. This configuration is stable, well-understood, expandable, secure, and highly functional.

2.0 Background

2.1 Relevant Constituents

The primary stakeholders and customer end-user personnel using NASA JSC EHR products and services are core constituents supporting NASA HH&PD's medical care operations.

They come from the following functional areas:

2.1.1 Flight Medicine

The Flight Medicine Clinic at JSC is responsible for capturing complete documentation of patient clinical encounters for Active Astronauts, Dependents, Aircraft Operations Division (AOD) personnel, Flight Directors, International Astronauts, and Retired Astronauts. EHR documentation in the Flight Medicine Clinic contains, but is not limited to: annual physical exams, periodic visits (sick visits, immunizations, etc.), flight medical clearance notifications, workman’s compensation documentation, consultant reports, lab reports, PACS imaging reports, audiology exams, dental exams, internal correspondence (release of information, request for records, and clinic survey letters), private medical conference notes, patient debrief letters, and flight-related exams (including PACS imaging reports). Within the Flight Medicine location of care, there are 3 subordinate locations to allow separate management of International Partner (IP) charts: Japanese Aerospace Exploration Agency (JAXA), European Space Agency (ESA), and Canadian Space Agency (CSA.)

2.1.2 Lifetime Surveillance of Astronaut Health

The Lifetime Surveillance of Astronaut Health (LSAH) program is a proactive health screening and monitoring program managed by epidemiologists and designed for active and retired astronauts. The program aims to detect and prevent occupational-related injuries or diseases that may affect astronauts. It examines acute and chronic health issues among astronauts and identifies the risks associated with their occupational exposures, beginning with their active service and continuing for their lifetime.

2.1.3 Occupational Health

The Occupational Medicine Clinic (OMC) at JSC is responsible for capturing complete documentation of patient clinical encounters for NASA Civil Servants, Contractors, and JSC visitors. EHR documentation in the Occupational Medicine Clinic contains but is not limited to annual physical exams, periodic visits (sick visits, immunizations, etc.), workman’s compensation documentation, provider written opinion letters, lab reports, PACS imaging reports and diagnostic tests (PFTs, audiometry reports, and vision screenings).

2.1.4 Behavioral Health

The Behavioral Health Department at JSC is responsible for capturing complete documentation of patient clinical encounters for Active Astronauts, Dependents, AOD personnel, Flight Directors, International Astronauts and Retired Astronauts (case by case basis), OMC Civil Servants and contractors. JSC provides primarily supportive, therapy, counseling and family support services, office-based evaluation of routine mental health conditions in healthy (employed) populations, and some use of screening inventories (PHQ9, etc.) and neurocognitive testing including formal testing tools. The Behavioral Health Program (BHP) leverages the EHR’s storage and infrastructure, but due to the very sensitive nature of BHP data, the charts are stored separately from other EHR data, and access is strictly controlled. JSC segregates behavioral health / employee assistance program records from routine medical records to avoid any possibility of unapproved identification of behavioral health engagement by employees, even if details of the encounters are secured.

Currently this is done through the use of separate charts per patient, fully independent of each other. To satisfy NASA requirements, a Notification of Contact form is filled out and stored in the EHR, but this form only contains basic demographic information about the clinical encounter.

2.1.5 Employee Assistance

NASA’s Employee Assistance Program (EAP) requires a stable electronic health record system that allows clinicians to document clinically relevant data at the point of care. The EAP implementation will mirror the implementation for BHP—the two groups have very similar requirements.

2.1.6 Neutral Buoyancy Lab (NBL)

The Neutral Buoyancy Lab at JSC’s Sonny Carter Training Facility captures complete documentation of patient clinical encounters for Aerospace Physiology Specialists and Flight Surgeon/Diving Medical Officers. EHR documentation in the NBL location of care contains, but is not limited to, medical screenings, dive physicals, and periodic visits (sick visits, immunizations, etc.).

2.1.7 Star City/Moscow (Russia)

The Star City Clinic in Russia is responsible for capturing complete documentation of patient clinical encounters to provide medical support to Astronauts, Dependents, and NASA employees in Russia. EHR documentation in the Star City and Moscow locations of care contains, but is not limited to, medical screenings and periodic visits (sick visits, immunizations, etc.).

2.1.8 Test Subject Screening (TSS)

The Test Subject Screening Department at JSC is responsible for capturing complete documentation of patient clinical encounters for the Test Subject Screening participants.

EHR documentation in the Test Subject Screening location of care provides encounters that conduct tests for ground-based research or microgravity studies. It contains but is not limited to annual physical exams.

2.1.9 White Sands Test Facility (WSTF)

JSC’s White Sands Test Facility in New Mexico captures complete documentation of patient clinical encounters for individuals who work on projects within NASA’s core capability.

EHR documentation in the WSTF location of care contains but is not limited to, medical screenings, annual physical exams, periodic visits (sick visits, immunizations, etc.), audiology exams, vision exams, and management of occupational work injuries and/or illnesses.

2.2 Current Electronic Health Record

The NASA JSC EHR system offers comprehensive medical and occupational health care delivery according to federal, agency, program, and organizational requirements, regulations, policies, and standards. The system holds approximately 30,000 records for employees dating to the beginning of the U.S. Space Program in the early 1960s. It consists of a variety of file types and data sets and including scanned images such as pdf files. The EHR size, excluding PACS files, is approximately 5 TB.

The NASA JSC EHR generally consists of:

• Intuitive user interfaces for data capture and review.

• A secure, centralized data repository for data storage.

• Computerized physician order entry (CPOE), and clinical decision support capabilities for facilitating clinical workflows and automation.

• An open data architecture for standards-based interoperability and data exchange with other internal HH&PD IT and external service provider systems.

The current implementation is on-premises and meets all performance and security requirements. There are no physical or technical issues with the existing implementation, and none are anticipated with an on-premises replacement. Based on market research, our EHR replacement deadline, infrastructure related constraints associated with cloud-based solutions, and the level of comfort with our current implementation, it is NASA’s intent to implement an on-premises solution and migrate to a cloud-based EHR in the future. There are concerns relating to infrastructure and bandwidth required for viewing large, high resolution, medical quality PACS files. NASA does not intend to move to a cloud environment that would lead to a hybrid state, such as having PACS on-premises and EHR files in a cloud environment. NASA also defines a hybrid state as having EHR modules in both on-premises and cloud environments simultaneously. The timing of the future migration to cloud would likely have dependencies related to improvements to infrastructure or technology that would allow for increased efficiency of use, including viewing of large PACS files without a need for file downloads. Additionally, any future move to a Cloud-based implementation must ensure the highest standards of data protection, confidentiality, and compliance with government regulations, including the Federal Risk and Authorization Management Program (FedRAMP).

JSC possesses a large data center utilized by multiple NASA organizations. The cost for this facility (power, generator backup, cooling, hardware racks, etc.) is not borne by the organizations that utilize it. An on-premises implementation of EHR software will be housed in this facility. Given this scenario, a cloud-based implementation would not generate cost savings typically seen in commercial applications of cloud software, however JSC recognizes there are technical benefits to cloud environments.

The current on-premises implementation utilizes a virtualized server environment consisting of six physical Supermicro SYS-2029U-TR servers.

• Each Server includes 768 GB RAM and 2 Intel Xeon Gold 6226 CPUs running at

2.70 GHz each.

• Each CPU includes 16 cores for a total of 32 cores per each Supermicro box.

• Each of the 6 machines runs Windows Server Datacenter and uses VMWare Six at a minimum version level of 6.7.0.

A storage area network (SAN) providing tiered storage consisting of approximately 15 TB available Solid-State-Drive (SSD) “fast” storage and approximately 45 TB of “slow” spindle storage is available to these machines. Of note, this environment supports operations of approximately 70 virtual machines not associated with the EHR.

NASA maintains an information technology support staff and is accustomed to providing tier-one and some tier-two support. This staff includes system and business analysts, infrastructure specialists, IT architects, system engineers, and service desk personnel.

Support provided by NASA IT staff includes making changes and customizations to the current system to address evolving spaceflight medicine practices and the development of custom forms and workflows for utilization within the EHR software system. NASA IT support personnel will assist the selected EHR contractor during the implementation phase of the EHR replacement project. This team is well versed in supporting the current implementation on-premises with some components in the cloud. NASA will utilize its internal IT support staff to continue to provide support to the new EHR software system at the same level as the current system.

NASA IT staff is very familiar with exporting data. NASA IT staff have the capability and knowledge to utilize standard SQL APIs. The current Electronic Health Record (EHR) system relies on over 50 connections, that include formats and protocols such as HL7, TXT, PDF, XML, CSV, JPG, GIF, TIFF, PNG, MDF, HTML, PST, SQL, API, DICOM, MLLP, SMTP, WCF, SOAP, FILE, FTP, WCF-Custom, Windows SharePoint Services, WCF-SQL, WCF-WSHttp, WCF-Basic HTTP, TCP/IP, and SMB. Many connections rely on BizTalk interfaces between the EHR and downstream systems. NASA maintains a direct, NASA procured, license for Biztalk that can be utilized with another EHR if necessary. Given BizTalk’s projected end of life in the next four to six years, NASA is open to utilizing a different interface engine, whether native to the proposed software or an additional commercial product, so long as existing connections are replicated or functionally replaced.

2.3 Unique Attributes

• We require the ability to manage multiple unique and separate charts per patient.

• We do not bill.

• We do collect insurance information but do not file claims.

• We do not use practice management software but may be interested in utilizing some features and functionality.

• We do not allow self-scheduling.

• We interface with NASA’s SharePoint and a file server outside the EHR but on our local network.

• We actively use both ICD-9 and ICD-10 codes. We do not participate in state or federal quality reporting.

• We require the use of federally approved forms for employee exams and reporting of workplace injuries.

• We have a heavy reliance on custom reporting for tracking specific data entered into the EHR. This includes qualifications such as flight, dive, and other certifications and the associated recurring requirements to maintain these certifications. A wide variety of real time data is queried for many daily, weekly, monthly, and annual data calls. Reports are both pre-build and created on-the-fly to support program needs.

• We require system functionality, including scheduled downtimes or other unavailability to be managed 24x7 worldwide.

• We rely heavily on a specialized pharmacy that uses a custom formulary, maintains a limited inventory, and compounds medications.

2.4 Unique Services

• Extensive vision and auditory testing, including hearing conservation.

• Behavioral health services as well as an Employee Assistance Program.

• Support for reacclimating astronauts physically, psychologically, and operationally when they return from microgravity. Unique workflows to obtain data from astronauts inflight to support medical monitoring by physicians on the ground.

• Annual OSHA and occupational health exams and certifications specific to NASA operations.

• Occupational health workplace injury, exposures, surveillance, tracking, and reporting.

While JSC provides unique services and gathers unique data, there are many similarities to standardized clinical care, workflows, and documentation. The key difference is a heavy reliance on the creation and use of custom forms and workflows to capture unique data. Data is gathered through a combination of in-person visits, private medical conferences where the provider inputs a visit note, and API downlinks from medical devices integrated with the EHR.

Using physical re-acclimatization for astronauts as an example, EHR use and documentation would look similar to a typical strengthening and reconditioning program for a debilitated patient. Protocols use normal physical therapy processes, devices, and regimens and data captured in the EHR is standard. Duration, intensity, specific exercises performed, and additional custom data collected will be specialized to meet the unique demands of returning from a microgravity environment.

2.5 EHR Usage for Astronauts

• The EHR manages data throughout an astronaut's career, from initial application until death.

• Requirement to collect discrete and granular data that will be used for approved research programs.

2.6 Additional background information

• The current EHR configuration uses Athena Flow with bolt on software to handle labs, PACS, device integration, and connections to other supporting systems.

• The Certified Health IT Product Listing (CHPL) maintained by the Office of the National Coordinator for Health Information Technology (ONC HIT) reflects that Athena Flow is certified in 43 of 54 ONC HIT criteria, including ONC HIT 170.315(b)(10).

• EHR records are stored on premises at JSC with backups at White Sands Test Facility.

• International sites and subordinate locations access the current on-prem EHR via remote access through a connection to a terminal server. (Remote access is defined as EHR access occurring at a non-JSC Clinic location.)

The EHR client runs within the bounds of the terminal server. Select personnel may have an EHR client installed on a local workstation that they carry on their person. In all cases network connections to the terminal server and EHR server route over data pathways that are VPN secured at the network or application level, or both.

• NASA is responsible for ensuring compliance with foreign requirements for international partner astronaut information housed in the EHR system.

• JSC uses OSHA standard reporting for occupational medicine issues. Other reports are local custom reports (such as compliance with annual astronaut physicals, flight and dive qualifications, etc.) Most of these qualification reports have custom interval, frequency and content requirements and are used to track clearance and certification currency.

• Primary encounter information is stored using the current EHR software. JSC maintains parallel file systems for file storage such as consult reports. Imagery is maintained in a separate PACS system.

• All EHR connections are terrestrial in origin. Data provided by in flight systems is routed through Mission Control and via Private medical Conferences with providers that input notes directly into the EHR. Connectivity should be designed to ensure on demand availability from users operating at JSC.

• The current EHR system interfaces with multiple different third-party modules (PACS, audiology, pharmacy, etc.) The ability to reduce some of the module interfaces is desired but an interfaced system will meet the needs of the JSC clinic.

• JSC does not dispense medications that are not commercially available in the US.

Whether standard formulary or compound, JSC only uses FDA approved medications. There are off label uses and non-standard dispensing (for example, JSC may issue an entire year’s supply of medication for an astronaut being sent to the International Space Station for a yearlong mission). JSC also tracks expiration dates not just based on date of dispensing but also based on manufacturer’s expiration date.

• The constituent components in compounded medications are identified by standard FDA naming. JSC only uses FDA approved medications even in compounded medications. Volume could be up to a year supply of the medication at a time, in standard or near standard dosing, though off-label use is possible.

Usually, yearlong supply would only be required for up to six individuals at a time.

• NASA uses e-prescribing in its medical offices in Moscow and Star City, Kazakhstan. However, medications prescribed are issued from NASA stock.

NASA does not prescribe to or interface with foreign pharmacies.

• NASA EHR data elements and terminology largely utilize standard EHR structures, but there are some non-standard data/terminology structures that require customization.

• The JSC clinic does not provide dental care. Dental records from outside consultants are received via fax or email and scanned into the EHR.

• JSC pharmacy utilizes both commercial and custom software. Frameworks is utilized for operations and JSC chooses to manually reconcile between the pharmacy systems.

3.0 Scope of Work

The scope of the tasks included in this SOW include the following:

• The deployment of an EHR software solution using an on-premises implementation with a well-documented path to the cloud with an effective go-live date no later than 7/7/2025. NASA’s intent is to implement an on-premises solution and move to cloud in the future. The government reserves the option to go to cloud-based solution immediately.

• Items and services required as part of this project include a current state assessment, project and product implementation plans, product integration and configuration, tailored group and individual training, and implementation support.

• The implementation of a comprehensive EHR solution accessible from secure local and remote, as well as national and international NASA HH&PD care locations to support critical programs, functions, and services. (See Figure 1 – NASA JSC EHR Edge Location End-Points Diagram).

• The implementation of a comprehensive EHR solution to support NASA HH&PD's staff and patient population sizes includes supporting:

o Current number of patient records in the system is 27,401.

o 5,200 average annual patient encounters.

o 181 total number of current full-time EHR users:

50 current users that perform e-prescribing:

• 43 Electronic prescribing of controlled substances (EPCS) users.

• 7 E-prescribing users.

o 131 current EHR users who perform no prescribing.

o 128 current EHR clinicians (clinician = user that accesses the EHR to do clinical documentation and/or ordering. This includes the front desk/clinic support personnel due to their expanded role at the JSC clinic.)

o The number of EHR users fluctuates to meet agency needs.

• The development and implementation of a comprehensive systems integration solution focused on seamless, standards-based interoperability and real-time data exchange between diverse clinical systems (See Figure 2 – NASA JSC EHR System Interfaces Diagram.) to enable a cohesive and synchronized healthcare environment. This integration includes interfaces for data exchange with core internal ancillary clinical support systems and other internal secondary support systems as they are added. It also includes interfaces for data exchange with other external service provider systems, including diagnostic testing, medical consulting, telehealth services, and other external entity systems located at remote physical locations as they are added.

• Many JSC workflows depend on a multi-featured portal and secure messaging capabilities to communicate with patients, providers, employees, job applicants, and others. Secure messaging and document exchange directly to and from the patient’s chart is necessary from locations worldwide utilizing automatic and manual transmission of messages and documents. NASA strives for user interfaces that ensure accessibility for diverse user demographics and integrated security measures to safeguard patient privacy and comply with relevant healthcare regulations. JSC’s use of secure messaging spans multiple digital platforms and there is a heavy reliance on the capability to send large amounts of text, large files of varying formats, and document hyperlinks.

3.1 Technical Requirements

EHR software solution shall meet the requirements listed below to address the needs of JSC’s unique patients. JSC strives to deliver unparalleled care to its patient population of astronauts, employees, and contractors by meeting individual medical needs and supporting longitudinal research goals.

3.1.1 Data Management and Integration

3.1.1.1 Data Integrity and Migration

3.1.1.1.1 Migration of Data, Forms, and Hyperlinks

The contractor shall migrate data, forms, and hyperlinks from the existing EHR into the new EHR.

3.1.1.2 Interfacing and System Integration

3.1.1.2.1 Interface Support

The EHR software solution shall have an interface that can support connection to equipment and systems utilizing standard formats and protocols commonly used in the medical field, including HL7, TXT, PDF, XML, CSV, JPG, GIF, TIFF, PNG, MDF, HTML, PST, SQL, API, DICOM, MLLP, SMTP, WCF, SOAP, FILE, FTP, WCF-

Custom, Windows SharePoint Services, WCF-SQL, WCF-WSHttp, WCF-Basic HTTP, TCP/IP, and SMB, to replicate or functionally replace connections, including but not limited to those connections listed in the provided diagrams. If NASA's current interface is not utilized, the contractor shall provide any required commercial interface engine license as part of their proposed solution.

3.1.1.2.2 Integration with LDAP/AD

The EHR software solution shall integrate with organizational backup services, interface with LDAP/AD services for credential exchanges, and interface with institutional email relay services.

3.1.1.2.3 Lab Interfaces

The EHR software solution shall interface with lab instruments.

3.1.1.2.4 Expandable Storage

The EHR software solution shall be expandable to accommodate data storage needs and enable the interruption of extended processes by authorized personnel.

3.1.1.2.5 Protocols

The EHR software solution shall utilize LAN Datalink protocols for network infrastructure and adhere to TCP/IP standards.

3.1.1.2.6 Concurrent Users

The EHR software solution shall handle up to 50 concurrent users.

3.1.2 Software Features and Capabilities

3.1.2.1 Clinical Support and Decision-Making

3.1.2.1.1 Compliance with Selected ONC HIT Criteria

The EHR software solution shall comply with applicable standards in the Office of the National Coordinator for Health Information Technology (ONC HIT) Certification Program (See Section 11.0 Standards, Regulations & Compliance References). The proposed solution shall, at a minimum, be ONC HIT compliant in the following areas:

3.1.2.1.1.1 170.315 (a)(1) Computerized Provider Order Entry (CPOE – Medications

3.1.2.1.1.2 170.315 (a)(2) CPOE – Laboratory

3.1.2.1.1.3 170.315 (a)(3) CPOE – Diagnostic Imaging

3.1.2.1.1.4 170.315 (a)(4) CPOE – Drug-Drug, Drug-Allergy Interaction Checks

3.1.2.1.1.5 170.315 (d)(1) Authentication, Access Control, Authorization

3.1.2.1.1.6 170.315 (d)(2) Auditable Events and Tamper-Resistance

3.1.2.1.1.7 170.315 (d)(3) Audit Report(s)

3.1.2.1.1.8 170.315 (d)(12) Encrypt Authentication Credentials

3.1.2.1.1.9 170.315 (d)(13) Multi-Factor Authentication

3.1.2.1.1.10 170.315 (g)(10) Standardized API for Patient and Population

Services

3.1.2.2 Multi-factor Authentication

The EHR software solution shall allow for multi-factor authentication that meets standards outlined in Office of Management and Budget Memorandum M-22-09. (See Section 11.0 Standards, Regulations & Compliance References)

3.1.2.3 Risk Management

The EHR software solution shall meet the requirements from NIST SP 800-37, Risk Management Framework for Information Systems and Organizations standards at the appropriate categorization level of Low-High-Moderate (Confidentiality-Integrity- Availability), with the appropriate privacy overlay. (See Section 11.0 Standards, Regulations & Compliance References)

3.1.2.4 FIPS Standards

The EHR software solution shall comply with all applicable requirements from Federal Information Processing Standard (FIPS) 140-3 encryption standards and subsequent versions as defined. (See Section 11.0 Standards, Regulations & Compliance References)

3.1.2.5 Custom Formularies

The EHR software solution shall support custom formularies that allow for tailored medication management.

3.1.2.6 E-prescribing

The EHR software solution shall support electronic prescribing, prescription renewals, reminders, and reporting and alerting.

3.1.2.7 Medication Histories

The EHR software solution shall support the input of comprehensive medication histories ensuring complete records.

3.1.2.8 Prescription Database

The EHR software solution shall sustain a current and searchable database for prescriptions, ensure compatibility with varied prescription formats, and embed prescriptions within the system.

3.1.2.9 Free Text Searching

The EHR software solution will be capable of free text medication name searches and support comprehensive medication reconciliation management.

3.1.2.10 Clinical Recommendations and Alerts

The EHR software solution shall provide real-time recommendations and alerts based upon clinical guidelines and medical support system.

3.1.2.11 Lab Ranges

The EHR software solution shall provide normal and abnormal value ranges for each test and allow for graphical representation of individual test results.

3.1.2.12 Order Transmission

The EHR software solution shall facilitate the transmission of orders to various internal and external systems.

3.1.2.13 Support for CPOE

The EHR software solution shall support customizable Computerized Physician Order Entry (CPOE) order creation, enable providers to sign orders electronically and ensure workflow efficiency and compliance with healthcare protocols.

3.1.2.14 Orders for Specific Processes

The EHR software solution shall enable the generation of orders reflecting specific departmental processes and priorities, possess capabilities for order searching and filtering, and provide access for viewing order status based on user role permissions.

3.1.3 Customization and User Interface

3.1.3.1 Clinician Customizable User Interface

The EHR software solution shall have a customizable user interface that provides views of the patient’s diagnosis, problems, allergies, alerts, and medical history.

3.1.3.2 Patient Portal with Secure Messaging

The EHR software solution shall feature a patient portal that includes secure messaging and document exchange from any location, enabling both automatic and manual transmission of messages and documents based on user roles.

3.1.3.3 Messaging Management

The EHR software solution shall support messaging from various devices, automated sending of document links for patient completion, and the incorporation of received messages into the patient's chart.

3.1.3.4 Attachment File Formats

The EHR software solution shall allow the attachment of various file formats in patient communications, facilitate secure dialogue between patients and healthcare providers, and ensure any patient communications and completed documents via the portal are captured and stored in the patient chart.

3.1.4 Operational Support and Maintenance

3.1.4.1 Deployment and Maintenance

3.1.4.1.1 On-site Support

The contractor shall have personnel on-site to support the customer during initial project and configuration planning, pre-launch training, implementation, product launch, and stabilization.

3.1.4.1.2 Reserved

3.1.4.2 Performance Monitoring and Reporting

3.1.4.2.1 Error Logging, Alerts, and Analytics

The EHR software solution shall ensure error logging, provide alerts for system anomalies, and allow performance analytics.

3.1.4.2.2 System Backup and Availability

The EHR software solution shall ensure system availability of 99.9% and permit regular backups of all user and operational data.

3.1.4.2.3 Integrity Checks

The EHR software solution shall support routine integrity checks on software and hardware to safeguard critical system components.

3.1.4.2.4 Report Generation

The EHR software solution shall offer comprehensive and customized report-generation capabilities.

3.1.5 Patient and Medical Data Handling

3.1.5.1 Custom Forms and Fields

The EHR software solution shall allow the user to create and utilize custom forms and custom fields.

3.1.5.2 Management of Appointments

The EHR software solution shall allow for the creation and management of appointments based on user role permissions.

3.1.6 Access Controls

3.1.6.1 Role-based Access

The EHR software solution shall provide secure, role-based access control for system, sub-system, and patient data access.

3.1.6.2 Access and Amendment Control

The EHR software solution shall track access and amendments to records to ensure accountability and patient record integrity.

3.1.7 Clinical Documentation and Data Handling

3.1.7.1 Charting Functionality

The EHR software solution shall facilitate detailed clinical documentation, support behavioral health workflows with enhanced, role-based security compartmentalization, and enable comprehensive patient charting with tools for ad hoc notes, diagrams, and specialty forms. Behavior health records and employee assistance programs shall be separate and compartmentalized from other health records with no visibility to any user without specific permissions determined by JSC.

3.1.7.2 Chart Status

The EHR software solution shall allow a chart to be identified as inactive/archived to remove charts from view.

3.1.7.3 Chart Sorting

The EHR software solution shall allow charts to be sorted by patient type category from demographics.

3.1.7.4 Demographic/Insurance Editing

The EHR software solution shall allow edits of demographic/insurance information without recreating the record.

3.1.7.5 Referral Tracking

The EHR software solution shall support entering, tracking, and reporting on referrals.

3.1.7.6 Problem Lists

The EHR software solution shall enable the creation and modification of problem lists that include modifications, searching, and tracking deleted data.

3.1.7.7 Immunization Tracking

The EHR software solution shall support accepting and managing immunization data based on the user's role.

3.1.7.8 Free Text Entry and Search

The EHR software solution shall ensure data entry of at least 2,000 characters for free text fields and provide medication reconciliation features.

3.1.7.9 Outcomes and Results

The EHR software solution shall enable tracking and reporting of patient outcomes and lab results.

3.1.7.10 Document Searching

The EHR software solution shall allow the searching of documents by identifiers and free text.

3.1.7.11 Data Import/Export

The EHR software solution shall provide data import and export configuration and management.

3.1.7.12 Notes Management

The EHR software solution shall enable the secure transfer of various note types including telephone notes.

3.1.7.13 Version Control

The EHR software solution shall include version control for data records.

3.1.7.14 Data Retrieval

The EHR software solution shall enable automated data retrieval and importation according to customized workflows.

3.1.8 Training

3.1.8.1 The contractor shall provide training for the EHR software solution in a train-the-trainer format for up to eight super users and IT support staff, general format for all clinical users, and at the elbow training and support for super users and physicians at JSC during system launch.

3.1.9 Integration

3.1.9.1 An on-premises EHR software solution shall integrate into JSCs environment.

3.2 Additional Cloud Specific Implementation Requirements

3.2.1 Protection of Information

The government shall retain unrestricted rights to government data. The ordering activity retains ownership of user-created/loaded data and applications hosted on the contractor’s infrastructure.

3.2.2 Confidentiality and Nondisclosure

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In the performance of this contract, the Contractor assumes responsibility for protecting the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Disclosure of Government information by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

3.2.3 Authorization of System

The contractor shall perform audits of the security of the computers, computing environment, and physical data centers it uses to process NASA Data. Upon NASA’s request, the contractor shall provide NASA with each Audit Report to verify compliance with the security obligations under the contract.

3.2.4 Reporting and Continuous Monitoring

The contractor shall perform continuous monitoring and periodic audits of the operational controls within a contractor’s system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes in the system and environment.

3.2.5 Data Jurisdiction

The contractor shall identify all data centers where the data at rest or data backup shall reside. All data centers shall be guaranteed to reside within the Continental United States, Alaska, or Hawaii.

3.2.6 FIPS 140-3 Validated Cryptography for Secure Communications

The contractor shall use only cryptographic mechanisms that comply with FIPS 140-3 level 1 or higher as required to meet minimum FedRAMP control requirements appropriate for each particular cloud service provided by the contractor, given its intended use by NASA and FIPS 199 [IMPACT LEVEL]. (See Section 11.0 Standards, Regulations & Compliance References)

3.2.7 Audit Record Retention

The contractor shall comply with the FedRAMP audit record retention requirement to retain audit records online for at least ninety days.

3.2.8 FedRAMP

Cloud/SaaS EHR software solutions shall be hosted in an environment that is FedRAMP certified at the appropriate level (currently moderate.)

3.3 Schedule Requirements

3.3.1 Contractor Team

The contractor shall provide a listing of key Points of Contact planned for the project in the proposal.

3.3.2 Project Initiation

The contractor shall contact the identified JSC POC to begin work within 5 business days of award.

3.3.3 Master Project Plan

The contractor shall provide a Master Project Plan in accordance with the Data Requirements Document (DRD).

3.3.4 Launch Functional System

The contractor shall ensure a functional system is ready for use no later than 7/7/2025.

4.0 Deliverables

4.1 Master Project Plan. See DRD for specifications.

5.0 Travel

To request reimbursement for contractor partner travel expenses, the expenses should be pre-approved and reasonable according to the customary rates. Remote work is preferred whenever possible if it does not affect the project's quality or timeline requirements. NASA and the contractor's project leadership will negotiate the arrangements for travel-related events and team members together.

Anticipated on-site events include:

• Initial project configuration planning and implementation

• Clinical and medical staff training

• Soft launch, pre-launch, launch, and stabilization

Organizing on-site events helps achieve important project milestones and maintains efficient communication and teamwork among project team members.

6.0 Government Furnished Equipment

NASA will provide office and meeting spaces to contractors subject to appropriate notice.

The spaces will be equipped with guest wireless access. However, the contractors must bring their own computing equipment for the duration of the engagement.

Additionally, if the contractors require access to NASA systems, NASA will provide workstations based on advance notice. Adherence to the specified security protocols is crucial before access to NASA systems and facilities is granted. The contractor must ensure that all security requirements are satisfactorily met, aligning with NASA's commitment to maintaining the highest data integrity and facility security standards.

7.0 Security, Safety, and Quality

7.1 Safety and Quality

Ensuring the utmost safety and quality in the configuration, implementation, and maintenance of the NASA Electronic Health Record (EHR) system is paramount. The selected contractor must adhere to rigorous safety standards and quality assurance protocols throughout the project lifecycle. Emphasis will be placed on creating a secure, resilient, and reliable EHR system that complies with industry best practices, relevant regulatory requirements, and NASA's stringent standards.

The contractor will collaborate closely with NASA to identify potential risks and proactively implement risk mitigation strategies to enhance safety. Additionally, the contractor will establish clear documentation and reporting mechanisms for safety incidents and system anomalies, facilitating prompt identification and resolution.

In alignment with NASA's commitment to excellence, the Safety and Quality section underscores the importance of delivering a cutting-edge EHR system that not only meets the functional requirements but also sets the standard for safety, security, and reliability within electronic health records.

8.0 Export/Import Control

According to NASA's commitment to compliance with pertinent regulations and international standards, the Export/Import Control section within this SOW outlines the specific rules and guidelines governing the export and import of technology, information, and materials. Compliance with these regulations is mandatory, and the selected contractor must adhere to the following guidelines:

International Traffic in Arms Regulations (ITAR) – 22 CFR–Parts 120-130: The contractor must comply with ITAR, a set of United States government regulations that control the export and import of defense-related articles and services on the United States Munitions List. The U.S. Department of State administers ITAR.

Export Administration Regulation (EAR) – 15 CFR–Parts 730-774: The contractor must comply with EAR, which regulates the export and re-export of most commercial items. EAR is administered by the U.S. Department of Commerce and is designed to ensure that exports of sensitive items do not threaten national security.

It is imperative that the contractor fully understands and strictly abides by these regulations throughout the project's duration. Failure to comply with these exports and import control measures may result in severe legal consequences, including fines and restrictions on future business activities. NASA places a high priority on upholding national and international legal standards, and the contractor's commitment to compliance is integral to the success of the project and the broader goals of the space exploration community.

9.0 Interface Table and Diagrams

Figure 1 – NASA JSC EHR System to System Interface Table

Figure 1 shows external systems connected to the current JSC Electronic Health Record server program via networked connections.

# Item Function Interface Type Key Protocol Path

Export (from EMR) or

Import (into EMR) Description

1 BACKUP EHR (Commvault) N/A

2 Benson Audiology Support BizTalk HL7 Benson > CSV/FILE > BizTalk > HL7/MLLP > EMR Import

Moves audiology test results from the Benson systems and HearTrak application into EHR. Handles work orders that initiate audiology testing.

3 DocuTRAK Access to Medical, Consultative Report Store SMB (Manual file upload) *.* Import

Enables access to reports provided by outside providers from within an EHR patient record. The current EHR provides links to report files stored on a Windows file server that the JSC Clinic Community has named ‘DocuTrak’.

4 Dropbox Data Exchange File Server Dropbox SMB (Manual file upload) *.* Import

5 EasyOne Connect Pulmonary Function Test (PFT) Processing BizTalk HL7 Import Enables import of PFT results into EHR.

6 EMCNS -1

Dive Suit Qualifications Tracking BizTalk HL7 EMR > HL7 > BizTalk > XML > Sharepoint Export

Exports personnel qualification status info in the EHR to Sharepoint site via Biztalk to enable large scale review.

7 EMCNS -2

Flight Controller Qualifications Tracking BizTalk HL7 EMR > HL7 > BizTalk > XML > Sharepoint Export

8 EMCNS -3

Flight Crew Qualifications Tracking BizTalk HL7 EMR > HL7 > BizTalk > XML > Sharepoint Export

9 EMCNS -4

Test Subject Qualifications Tracking BizTalk HL7 EMR > HL7 > BizTalk > XML > Sharepoint Export

10 ezAccess Patient Portal Direct Connection OOS Export/Import Send/receives select data to/from EHR to a third-party website currently hosted out-of-state for presentation on prebuilt forms.

Information Platform for Analytics and Aggregation (IMPALA) Nightly Analytics Pull Direct Connection

Oracle v19c & SQL Export

Enables routine, periodic and scheduled updates of analytical body models in the IMPALA system. IMPALA initiates the connection to

EHR.

Lifetime Surveillance of Astronaut Health (LSAH) LSAH Program Support BizTalk HL7 Export

Enables incorporation of data into longitudinal study databases.

This data is exported from the EHR. Data includes but is not limited to renal ultrasounds, eye ultrasounds, MRI, OCT, PFT, X-ra, ECG, and patient demographics stored in the EHR

Medical And Research Syndication Site (MARSS) -1 Fundoscopy Data Handling BizTalk HL7 Export/Import

Bi-directional interface supporting Spaceflight Associated Neuro- Ocular Syndrome (SANS) project by providing the capability for non-

Medical And Research Syndication Site (MARSS) -2 OCT Data Handling BizTalk HL7 Export/Import

Medical And Research Syndication Site (MARSS) -3 PHS Data Handling BizTalk HL7 Export/Import

Medical And Research Syndication Site (MARSS) > -4 Visual Acuity Data Handling BizTalk HL7 Export/Import

17 Dr. First Medication Management N/A OOS Export/Import Electronic prescribing.

Multilateral Space Medicine Board (MSMB)

Medical Certification Review BizTalk HL7 Import

Provides the capability for International Partner medical personnel to medically certify astronauts for spaceflight using web server and browser

19 NASA AD X.500/LDAP Export/Import 20 NASA BOX SMB (Manual file upload) *.* Import 21 NASA EXCHANGE SERVER SMTP Export/Import

22 Orchard Interface Clinical Lab Support BizTalk HL7 Export/Import

Bidirectional interface to the Orchard Harvest and Orchard Copia software systems used in the JSC Clinical Laboratories. Handles work orders for laboratory operations.

23 PACS > Epihpany ECG Interface BizTalk HL7

CardioVascular Devices (XML/PDF) > Epiphany CardioServe (XML/PDF) > Synapse CV (HL7) > BizTalk (HL7) > EHR Export/Import

Bidirectional interface for the processing of ECG Results and ECG clinical work orders. Connects EHR to Epiphany Cardioserver by way of Synapse CV.

24 PACS > Fuji Synapse Radiology Interface BizTalk HL7

Radiology Device (DICOM)/Radiology Interp (PDF/Data Entry Form) > Synapse (HL7)> BizTalk (HL7) > EHR Export/Import

Bidirectional interface for the processing of X-Rays/MRI and X- Rays/MRI clinical work orders. Connects EHR to Fuji Synapse

25 PACS > SynapseCV Ultrasound Interface BizTalk HL7

Cardiovascular Device (DICOM)/ Cardiovascular Interp (PDF/Data Entry Form) > Synapse CV (HL7) > BizTalk (HL7) > EHR Export/Import

Bidirectional interface for the processing of work orders for cardiovascular ultrasounds. Connects EHR to SynapseCV (Prosolve)

26 SiteMinder Launchpad Export/Import