RFP_AHRQ-17-10005.pdf

Request for Proposal v. Oct-16; FAC 91 AHRQ-17-10005 PSOPPC and NPSD Systems Page 1 of 142

Request for Proposal No. AHRQ-17-10005

PART I - THE SCHEDULE

SECTION A - SOLICITATION FORM

Date Issued: Thursday, December 22, 2016 Date Questions Due: Tuesday, January 3, 2017, 7:00 PM EST Please Note: All questions and inquires will be processed on a non-attribution basis.

Date Notice of Intent Due: Monday, January 23, 2017 Date Proposals Due: Tuesday, January 31, 2017, 10:00 AM EST

You are invited to submit a proposal to the Agency for Healthcare Research and Quality (AHRQ) for Request for Proposal (RFP) No. AHRQ-17-10005 entitled “Patient Safety Organization Privacy Protection Center (PSOPPC) and Network of Patient Safety Databases (NPSD) Systems”. Your proposal must be developed and submitted in accordance with the requirements and instructions of this RFP.

Conflict of Interest: A significant organizational conflict of interest has been identified for this solicitation. See section L herein for additional information.

Solicitation Information: Please review the table of contents and refer to the appropriate section of this RFP for requirements, proposal instructions and evaluation information. The Government intends to award this contract without negotiations, so it is imperative that all questions are addressed during the solicitation phase, and that all proposals submitted include the required information and accept the terms and conditions as stated. Failure to comply with proposal instructions or submit required information may result in the removal of a proposal from consideration for award. Please review Section L carefully.

Proposal Intent: If you intend to submit a proposal in response to this solicitation, please inform the Contracting Officer of your intent by completing the Proposal Intent Response Form (See section L.11 and Attachment A) and send it to the Contracting Officer no later than Monday, January 23, 2017. You may mail it to the address below; fax it to 301-427-1740, Attention:

Michelle Beatty, Contract Specialist/Contracting Officer or email it to Michelle.Beatty@ahrq.hhs.gov.

Questions: All Questions regarding this solicitation shall be received in this office no later than the date shown above. All questions shall be submitted electronically by e-mail to Michelle Beatty, Contract Specialist/Contracting Officer, at the following email address:

Michelle.Beatty@ahrq.hhs.gov. Subject line shall read: Proposal Questions RFP No. AHRQ- 17-10005. Answers to questions and all solicitation amendments will be posted to the Federal

Business Opportunities web page: www.fbo.gov. It is your responsibility to monitor the web site.

PSOPPC and NPSD Systems Page 2 of 142

Additional Information:

a. A cost plus award fee (CPAF) contract is contemplated for a period of one year, with three one-year options.

b. The Government anticipates awarding one contract from this solicitation on or about

August 25, 2017.

c. Proposals submitted in response to this solicitation must state that they are valid for a period of at least 120 days (reference FAR clause 52.215-1 in Section L of this document.)

d. The NAICS code for this requirement is 541990 with a size standard of $15M.

Proposal Submission: The proposal shall be signed by an authorized official to bind your organization and must be received by the due date specified above. The proposal must be submitted to the following address:

Agency for Healthcare Research and Quality (AHRQ)* Division of Contracts Management* 5600 Fishers Lane* Mail Stop 06N34B* Rockville, Maryland 20857* Attn: Michelle Beatty, (301) 427-1781*

*All boxes must be clearly labeled with this information.

Please read this section carefully. Some mail and package delivery procedures have changed due to security controls. All mail and packages are screened at a local offsite facility before being delivered to 5600 Fishers Lane.

The U.S. Postal Service’s “Express Mail” does not deliver to our Rockville, Maryland address.

Please do not use this means of delivery for proposal submission.

Proposals delivered by commercial package delivery company (example: Fedex, UPS, DHL, etc.): Submit and label as instructed above. These companies are familiar with the delivery procedures at 5600 Fishers Lane.

Hand carried or hand carry courier service: The 5600 Fishers Lane building security does not allow packages to be delivered directly to the building. Hand carried or courier delivered proposals should be labeled as instructed above, however they must be delivered directly to the offsite screening facility at 12225 Wilkins Avenue Rockville MD 20852. Please note that anyone who arrives at the Fishers Lane location with a delivery will be directed to the screening facility, however this will cause delay. Packages will be accepted and date/time stamped at the screening facility. Please allow ample time as proposals cannot be date/time stamped until they have gone through security.

PSOPPC and NPSD Systems Page 3 of 142

System for Award Management: In accordance with Federal Acquisition Regulation, all contractors must be registered in the System for Award Management (SAM) database in order to conduct business with the government [See Section I - FAR clause 52.204-7 System for Award Management]. Access the System for Award Management (SAM) at http://www.sam.gov.

Reminder: The Procurement Integrity Act prohibits the unauthorized disclosure of, inquiry about, or acceptance of procurement information. Communications with any other individual outside the AHRQ contracting office may result in rejection of an offeror’s proposal. All requests for any information concerning this RFP should be referred to Michelle Beatty, (301) 427-1781 or e-mail:Michelle.Beatty@ahrq.hhs.gov. Please note e-mail requests should state subject as

RFP AHRQ-17-10005.

PSOPPC and NPSD Systems Page 4 of 142

Table of Contents

PART I ‐ THE SCHEDULE

SECTION A ‐ SOLICITATION FORM

SECTION B ‐ SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C ‐ DESCRIPTION/SPECIFICATION/WORK STATEMENT

SECTION D ‐ PACKAGING AND MARKING

SECTION E ‐ INSPECTION AND ACCEPTANCE

SECTION F ‐ DELIVERIES OR PERFORMANCE

SECTION G ‐ CONTRACT ADMINISTRATION DATA

SECTION H ‐ SPECIAL CONTRACT REQUIREMENTS

PART II ‐ CONTRACT CLAUSES

SECTION I ‐ CONTRACT CLAUSES

PART III – LIST OF DOCUMENTS, EXHIBITS AND ATTACHMENTS

SECTION J – SOLICITATION LIST OF ATTACHMENTS

PART IV– REPRESENTATIONS AND INSTRUCTIONS

SECTION K ‐ REPRESENTATIONS, CERTIFICATIONS, AND OTHER STATEMENTS OF OFFERORS

SECTION L ‐ INSTRUCTIONS, CONDITIONS AND NOTICES TO OFFERORS

SECTION M‐ EVALUATION FACTORS FOR AWARD

PSOPPC and NPSD Systems Page 5 of 142

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

“Patient Safety Organization Privacy Protection Center (PSOPPC) and Network of Patient Safety Databases (NPSD) Systems”. See Section C for a complete description.

B.2 ESTIMATED COST, FIXED FEE and AWARD FEE

a. The Estimated Costs (exclusive of fees) for performance of the work under the base period of this contract, including direct and indirect costs is $ To Be Determined (TBD).

b. The Fixed Fee for the base period of this contract is $TBD. The fixed fee shall be paid in installments based on the percentage of completion of work, as determined by the Contracting Officer. Payment shall be subject to the withholding provisions of the Clause ALLOWABLE COST AND PAYMENT and FIXED FEE incorporated herein.

c. The Award Fee Pool that may be earned for the base period is (TBD). Award fee earned shall be based upon an evaluation and determination by the Government in accordance with the procedures detailed in Section H.

d. The total contract value, represented by the sum of the estimated cost, plus the fixed fee and award fee pool for the base period is as follows:

Period of

Performance Services Estimated

Cost Fixed Fee Award Fee

Pool* Total

Base Period Severable $ $ $ $

*The offeror shall allocate at least 50% of the total fee to the award fee pool.

B.3 OPTION COSTS

If the Government exercises its option(s) pursuant to the option article in Section H of this contract, the Government’s total contract amount represented by the sum of the estimated cost, fixed fee, and award fee pool will be revised as follows:

Period of Performance

Services Estimated Cost Fixed Fee Award Fee Pool* Total

Option Period 1 Severable $ $ $ $

Option Period 2 Severable $ $ $ $ Option Period 3 Severable $ $ $ $

*The offeror shall allocate at least 50% of the total fee to the award fee.

The base period and each option are separate and distinct from one another for accumulation of costs and billing purposes.

PSOPPC and NPSD Systems Page 6 of 142

OPTION TASKS

SOW Task Services Estimated Cost Fixed Fee Award Fee Pool*

Total

Task 3.5.1 Option Year 1

Severable

Task 3.7 Option Year 1

Severable

Task 13 Option Year 1

Severable

Task 15 Option Year 1

Severable

Total

Task 3.5.1 Option Year 2

Severable

Task 3.7 Option Year 2

Severable

Task 13 Option Year 2

Severable

Task 15 Option Year 2

Total

Task 3.5.1 Option Year 3

Severable

Task 3.7 Option Year 3

Severable

Task 13 Option Year 3

Severable

Task 15 Option Year 3

*The offeror shall allocate at least 50% of the total fee to the award fee.

B.4 PROVISIONS APPLICABLE TO DIRECT COSTS

a. Items Unallowable Unless Otherwise Provided

Notwithstanding the clauses, ALLOWABLE COST AND PAYMENT, and FIXED FEE, incorporated into this contract, unless authorized in writing by the Contracting Officer, the costs of the following items or activities shall be unallowable as direct costs:

(1) Acquisition, by purchase or lease, of any interest in real property;

(2) Rearrangement or alteration of facilities;

PSOPPC and NPSD Systems Page 7 of 142

(3) Purchase or lease of any item of general purpose-office furniture or office equipment regardless of dollar value. (General purpose equipment is defined as any items of personal property which are usable for purposes other than research, such as office equipment and furnishings, pocket calculators, etc.);

(4) Accountable Government property;

(5) Travel to attend general scientific meetings;

(6) Foreign Travel;

(7) Any costs incurred prior to the contract's effective date;

(8) Rental of meeting rooms not otherwise expressly paid for by the contract;

(9) Any formal subcontract arrangements not otherwise expressly provided for in the contract;

(10) Consultant fees;

(11) Information Technology hardware or software;

(12) Food and Beverages; and

Note: Food and Beverages are unallowable costs. Contracting Officer Authorization for Food and Beverages will be only made as specifically authorized by statute, which is extremely rare. The contractor shall not provide food or beverages of any type. The contractor shall not accept food or beverages, even if included in, or provided ‘free’ as part of a meeting/conference ‘package’.

b. Travel Costs

This contract is subject to the provisions of Public Law (P.L.) 99-234 which amends the

Office of Federal Procurement Policy Act to provide that contractor costs for travel, including lodging, other subsistence, and incidental expenses, shall be allowable only to the extent that they do not exceed the amount allowed for Federal employees. The Contractor, therefore, shall invoice and be reimbursed for all travel costs in accordance with Federal Acquisition Regulations (FAR) 31.205-46.

The following applies to Educational Institutions: The Contractor shall invoice and be reimbursed for all travel costs in accordance with OMB Circular A-21 - "Cost Principles for Educational Institutions."

No funding or expenditures will be authorized under this contract for travel or meeting expenses of any person that is not an employee of the contractor or approved subcontractor in accordance with the terms of the contract. See 31 USC § 1345 for appropriations restrictions.

PSOPPC and NPSD Systems Page 8 of 142

B.5 CONTRACTING OFFICER AUTHORIZATION

Other provisions of this contract notwithstanding, approval of the following items within the limits set forth is hereby granted without further authorization from the Contracting Officer.

To Be Determined

PSOPPC and NPSD Systems Page 9 of 142

SECTION C - DESCRIPTION/SPECIFICATION/WORK STATEMENT

Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work as follows:

Statement of Work

Please note: Unless otherwise noted under a specific task, this Statement of Work applies to the base period and all options (if exercised). However, optional task may be exercised once per year, in conjunction with the option exercise for Option Years 1, 2 and 3.

NOTE: HIPAA applies to this Statement of Work.

Introduction/Background

Agency for Healthcare Research and Quality (AHRQ) was designated by the Secretary to implement and administer the Patient Safety and Quality Improvement Act of 2005 (Patient Safety Act). The Patient Safety Act and its regulations (the Patient Safety Rule) authorized the creation of Patient Safety Organizations (PSOs), which collect, aggregate, and analyze confidential and privileged information regarding the quality and safety of healthcare. The goals of the Patient Safety Act are to encourage the expansion of voluntary, provider-driven initiatives to improve the quality and safety of health care; to promote rapid learning about the underlying causes of risks and harms in the delivery of health care; and, to share those findings widely, thus, speeding the pace of improvement. The Patient Safety Act also authorizes AHRQ to facilitate the development of a Network of Patient Safety Databases (NPSD), to which PSOs can voluntarily contribute non-identifiable patient safety event information.1 By law, the NPSD can only receive and report on non-identifiable, aggregated patient safety event information which will also be included in AHRQ’s annual National Healthcare Quality and Disparities Report (QDR). AHRQ understands the complexity of ensuring that information submitted to the NPSD is non-identifiable and the costs associated with adherence to the confidentiality provisions of the Patient Safety Rule. Therefore, AHRQ established the PSO Privacy Protection Center (PSOPPC) to assist PSOs and others with meeting the statutory requirement that patient safety event information, especially where it is Patient Safety Work Product (PSWP),2 be made non-identifiable prior to sending to the NPSD. The PSOPPC will receive patient safety information in a standardized format (AHRQ Common Formats) and render it non-identifiable before transmitting it safely and efficiently to the NPSD.

The Patient Safety Rule requires PSOs, to the extent practical and appropriate, to collect patient safety event data from providers in a standardized manner. AHRQ’s common definitions, data elements, and reporting formats are known as the Common Formats. The PSOPPC only accepts data represented as AHRQ’s Common Formats. The PSOPPC also delivers technical assistance to PSOs to include the use of AHRQ’s Common Formats.

1 Full details of the Patient Safety Act and Patient Safety Rule can be found at www.pso.ahrq.gov.

2 PSWP is defined in the Patient Safety Rule. Please refer to the website for details:

https://pso.ahrq.gov/legislation/rule

PSOPPC and NPSD Systems Page 10 of 142

The Common Formats include event descriptions, specifications for patient safety aggregate reports, delineation of data elements to be collected for different types of events, and technical specifications for electronic data collection and reporting. The technical specifications promote standardization of collected patient safety event information by stipulating rules for data collection and submission. The PSOPPC maintains the Common Formats and the technical specifications. The Common Formats and the associated technical specifications are available on the PSOPPC Web site (www.psoppc.org) and AHRQ Web site (https://pso.ahrq.gov/about/org).

References:

Appendix A: Current PSOPPC System Environment Appendix B: Some Examples of NPSD Concept Wireframe Appendix C: AHRQ Technical Standards Profile Appendix D: The Relationship of the PSOPPC to the NPSD Systems Appendix E: Data Flow into the PSOPPC and Generation of Reports

Scope of Work Requirements

1. Maintain the Systems: The PSOPPC and NPSD (known as the “Systems”) are built around these guiding principles:

a. All information received by the Systems shall be handled with extreme care to ensure its confidentiality and security, particularly Patient Safety Work Product (PSWP), which may contain Protected Health Information (PHI) under the Health Information Portability and Accountability Act (HIPAA).

Refer to Section H.9. for more details about the Security and Privacy Requirements.

b. All Systems processes shall adhere to high standards of quality control.

c. The Systems shall be managed efficiently and transparently.

d. The PSOPPC System (See Appendix A for description of the PSOPPC environment) shall operate in tight coordination with the NPSD System, the ultimate recipient of non-identifiable information processed by the PSOPPC contractor, and other stakeholders (where applicable).

e. The enterprise development/solution, architecture design, data modeling, ease of migration (e.g., cloud based), shall be adaptable/capable to receive large volumes of records from any database systems and shall be robust and agile and meet industry standards.

Please note: AHRQ has not yet built/implemented the NPSD environment nor received any data in the NPSD environment. The current NPSD concept wireframes are available in Appendix B.

1.1. Confidentiality and Security Protections: The most critical aim of the

Systems is to protect the security and confidentiality of any patient safety event information in accordance with the Patient Safety Rule. Please see the attached Section H.9 Security and Privacy Requirements. The Contractor shall also take other steps that are deemed necessary by the COR and AHRQ Security Officer (SO) to adequately protect data confidentiality and security. (See more information on the Patient Safety Rule and Act at www.pso.ahrq.gov). These may reflect any potential new guidelines or requirements that HHS implements subsequent to award of

PSOPPC and NPSD Systems Page 11 of 142 the contract. The Contractor shall present the critical milestones in the project management timeline to the COR two (2) weeks after effective date of contract (EDOC). As needed, when new/upgraded software(s) and/or changes in requirements are made, the Contractor shall review, update, and evaluate critical milestones in the project management documents every week. The Contractor shall draft and finalize project management documents within two (2) weeks after receiving comments from AHRQ.

1.2. Security and Privacy Requirements: The Contractor shall be responsible for the security and the privacy of the system. All Federal public Web sites must comply with Section 207(f)(1)(b)(iv) of the E-Government Act of 2002, which requires organizations to have security protocols to protect information. The PSOPPC System has been determined to be a Federal Information Processing Standards (FIPS) category level moderate. The Contractor shall immediately report any unauthorized access to the COR and AHRQ System Owner. The Contractor shall ensure that Personally Identifiable Information (PII) data is never allowed on a system with public (Internet) access unless given express permission from the Contracting Officer. The Contractor shall develop a schedule for periodic (e.g., bi-annual) review/update and develop protocols for periodic review.

1.3. Maintain Systems Security Plan and other requirements: The Contractor shall identify to the AHRQ SO all known security and privacy requirements to include continue reporting of Risk Analyses, Plan of Action and Milestones (P.O.A.&M) completion, and a discussion that imparts a clear understanding to the AHRQ SO of the Risk Profile (including Residual Risk) of the System. The Contractor shall develop, maintain, review and update the Nessus report on a monthly basis. The Contractor shall conduct and maintain a PIA, as defined by Section 208 of the E-Government Act of 2002 and Federal Acquisition Regulation (FAR) Clause 52-239-1, and required by HHS policy. The PIA shall be completed in accordance with HHS PIA guidance (http://www.hhs.gov/ocio/securityprivacy/privacyresources/pias.html).

Periodic reviews, no less than annually, shall be conducted to determine if a major change to the system has occurred, and if a PIA update is subsequently required. If it is determined that an update is necessary, the Contractor shall make the necessary changes to the PIA. The Contractor shall submit the Security Controls Assessment and Contingency Plan Test Report on an annual basis. The Contractor shall maintain a maintenance log available to the COR on a monthly basis.

1.4. Software Engineering: The Contractor shall establish and adhere to a high level of software development, testing, documentation and quality control standards and procedures. The Contractor shall deliver documentation of the proposed procedures and tools to be used for these functions and review the procedures and tools with the COR for concurrence. Prior to final closeout and accounting, the Contractor shall create a schedule for trimming production programs, logs, listings, and format programs as part of the final close-out procedures. The Contractor shall deliver documentation of all proposed hardware, software, security, PSOPPC and NPSD Systems Page 12 of 142 backup/recovery, networking and other Information Technology (IT) infrastructure components and solutions needed to support all contractual efforts and shall obtain approval of the proposed solutions from the COR.

The Contractor shall also prepare responses to periodic HHS reporting requirements for accounting for information technology (IT) activities within the Systems. For example, HHS requires that projects with an IT component distinguish between those costs which are Development / Modernization/Enhancement (DME) and those which are Steady State (SS) and report annually on these expenditures. The Contractor shall provide support in assessing and reporting such information. The Contractor shall use an industry standard, object-oriented software design and software technology solutions, three (3)-tier architecture, and enterprise reusable object software components to ensure cost-effective system development, operations and maintenance. The Contractor shall adhere to AHRQ Technical Standards Profile – Appendix C.

Specifications identified as “Standard” in the Disposition column shall be selected, unless the Contractor requests and receives a waiver from the Government. The Contractor shall use commercial off-the-shelf (COTS) components when possible. The Contractor shall adhere to the documentation standards and development guidelines contained in Section H.9 for all developed and deployed software products. The delivery schedule for documentation deliverables shall be identified in the Project Work Plan (PWP). For all of the above deliverables for this subtask, the Contractor shall review, update, and evaluate documents annually, and as needed due to changes. The Contractor shall also draft documents within two (2) months after EDOC. The Contractor shall finalize documents after receiving comments from AHRQ within two (2) weeks.

2. Project Management.

2.1. Project Management: The Contractor shall maintain methods to ensure that project tasks and subtasks are coordinated, aligned, and streamlined so that work progresses in an orderly, timely, and efficient manner (e.g., Integrated Master Schedule (IMS)). The Contractor shall maintain a method for planning future project activities so that tasks are completed within expected timeframes and budgets. The Contractor shall use quality control procedures to monitor and evaluate the quality of the products that will be delivered. The Contractor shall document all proposed project management methods and software tools for review by the COR. In addition, the Contractor shall provide the COR with documentation of the changes made to project plans and reports. The Contractor shall present the IMS timeline to the COR two (2) weeks after EDOC. The Contractor shall draft changes one (1) week or sooner after changes are made and finalize after receiving comments from AHRQ in two (2) weeks upon COR approval. The Contractor shall notify COR immediately if there are any changes via email/phone call and follow up with documentation

2.1.1. The Contractor shall identify activities that would require documentation such as backlogs, current activities, action, and

PSOPPC and NPSD Systems Page 13 of 142 validation. The Contractor shall develop, maintain/update, and document the issues identified in the Activities log and review the log on a weekly basis with COR.

2.2. Contract kick-off meeting: The Contractor shall schedule a conference call line and video/webinar link and coordinate with the COR for a meeting room. The Contractor shall develop an agenda and slides. The Contractor shall meet with the AHRQ team and whoever else AHRQ deems necessary within one (1) week of contract award. The Contractor shall send out meeting information and meeting materials (e.g., agenda, slides) at least twenty-four (24) hours prior to the meeting. The Contractor shall take notes during the meeting and submit the meeting minutes thirty-six hours (36) following the contract kick-off meeting.

2.3. Strategy Meeting with AHRQ: The Contractor shall hold in person meetings with AHRQ for a project review and strategy session twice a year (e.g., First in-person meeting may coincide around the same time as the PSO and Software Developer’s Annual Meetings) at either the AHRQ office in Rockville, Maryland or the Contractor’s office. The Contractor shall coordinate the meeting with the COR by scheduling a meeting room, call in number and video/webinar link, agenda and provide minutes (and, if applicable, develop an Action log) after the meeting. The Contractor shall send out meeting information and meeting materials (e.g., agenda, slides) at least twenty-four (24) hours prior to the meeting. The Contractor shall take notes during the meeting and send out minutes thirty-six (36) hours after the meeting.

2.4. Participate in Weekly Conference (Phone, video, webinar) Meetings with the COR: The Contractor shall participate in formal conference meetings (Phone, video, webinar) with the COR and other staff as assigned, as frequently as once a week, to review progress, identify problems and discuss possible solutions to problems. In advance of the conference meeting, the Contractor shall prepare and send an agenda which highlights key activities and any problems encountered. The Contractor shall take notes and deliver minutes (and, if applicable, develop an Action log) after the meeting (thirty-six (36) hours after the meeting) to the COR.

It is anticipated that less formal communications will also occur on a more frequent basis, as needed with the COR, and other AHRQ staff as assigned. The Contractor shall send out meeting information and meeting materials (e.g., agenda, slides, call-in number, video/webinar link) at least twenty-four (24) hours prior to the meeting.

2.5. Develop Draft PWP and Use Project Management Industry Best Practices and Earned Value Management (EVM) System: The Contractor shall use an EVM System in the management of this contract that is consistent with American National Standards Institute/Electronic Industries Alliance Standard (ANSI/EIA-STD)-748 guidelines. The Contractor shall report earned value monthly based on actual data from (or reconcilable with) its accounting systems. The Government and the Contractor shall negotiate the level of the Work Breakdown Structure (WBS) at which earned value

PSOPPC and NPSD Systems Page 14 of 142 shall be reported. If subcontractors are used, the Contractor shall develop and implement a system to ensure that its subcontractors comply with this requirement, and must address performance at the prime and subcontractor level. The Contractor shall deliver with the PWP, a contract-level IMS that rolls up all time-phased WBSs for the individual tasks. This IMS shall include the dependencies that exist between tasks.

The Contractor shall deliver, review and update the PWP and Critical Paths at the contract-level.

2.5.1. The Contractor shall report the following EVM data for the entire project and specific deliverables/milestones in the monthly report using an AHRQ customized Contract Performance Report (CPR) format that will be provided after award:

a. Planned Percent Complete.

b. Actual Percent Complete.

c. Budget at Completion (BAC) – total planned cost at project completion.

d. Budgeted Cost of Work Scheduled (BCWS) – cumulative expected (planned) cost of work scheduled to be completed by a given period.

e. Actual Cost of Work Performed (ACWP) – cumulative amount actually spent for completed activities at a given period.

f. Budgeted Cost of Work Performed (BCWP) – cumulative planned cost of work completed (the “earned value”).

g. Cost Variance (%) CV – the difference between the actual cost and the work performed converted into a percentage.

h. Schedule Variance (%) SV – the variance between the actual and planned scheduled converted into a percentage.

2.5.2. The Contractor shall provide a corrective action plan with the monthly earned value report in cases where cost or schedule, as measured by Cost Performance Index (CPI) and Schedule Performance Index (SPI), exceeds the established performance thresholds. The Government and the Contractor shall negotiate the performance thresholds. All IT related performance thresholds shall not exceed the department’s standard of plus or minus 10% or a corrective action plan needs to be submitted. The corrective action plan shall address the following items:

a. Brief description of the issue (identifies the nature of the issue as cost, schedule, performance or resources and explains why the issue came to be).

b. Impact on project completion.

c. Brief description of the corrective action plan strategy.

d. Corrective tasks/actions that are required to eliminate or mitigate the issue, including task/action number, point of contact, start and end dates and comments.

PSOPPC and NPSD Systems Page 15 of 142

2.5.3. If the corrective action plan requires re-baselining (the performance baseline), the corrective action plan also shall address the following items:

a. The proposed new baseline.

b. The reason(s) why re-baselining is required.

c. Documentation of the reasonableness of the proposed new baselines and the accuracy of any new cost estimates.

2.5.4. The Performance Baseline, WBS, BCWS, Integrated Master Schedule, and monthly earned value report shall clearly breakout the deliverables and activities related to the development and maintenance of systems, software, databases, and Web sites. It shall also clearly separate development, modernization and enhancement (DME) deliverables and activities from operations and maintenance deliverables and activities.

2.5.5. Monthly EVM reports shall be submitted to the COR (and other AHRQ staff as designated by the COR) by the 10th calendar day after the end of the reporting month. If the tenth (10th) calendar day falls on a weekend or holiday, the EVM report will be submitted the Friday before the weekend or holiday. If the final EVM report is not completed by the tenth (10th) calendar day, an estimate can be filed until the final monthly report is completed. The Contractor shall notify the COR if an estimate will be filed.

2.5.6. Revised/Final PWP: After receiving feedback from AHRQ on the PWP draft, the Contractor shall deliver a revised overall PWP that details the life cycle of the project, including phases, iterations, and key milestones including integration points and procurement events, scope, cost, schedule, risks, and quality assurance for all systems and software. The draft (updated from the proposal submission) PWP shall be due two (2) weeks after EDOC. Subsequent PWPs will be due two (2) weeks after the Contractor receives AHRQ’s comments on the draft. The Contractor shall review and update on a weekly basis.

2.6. Prepare Quarterly Project Progress Reports: On a quarterly basis, the

Contractor shall submit to the COR written reports describing major activities of the project, beginning in the second quarter following the effective date. Each progress report shall list, by major task, project activities of the past quarter, the cost of those activities, the anticipated next quarter's high-level activities, problems encountered and proposed solutions, milestones, and any other information which has a significant impact on ongoing or planned activities or costs. Costs shall be reported by sub-tasks as well. The report shall also compare progress and resource expenditures to the original schedule and budget and provide explanations for any variances, assess whether the current total estimated contract cost is sufficient to complete the contract. The quarterly progress report shall be delivered to the COR no later than ten

(10) calendar days after the end of the reporting quarters (first and third

PSOPPC and NPSD Systems Page 16 of 142 quarters). The last quarter report shall be incorporated in the Annual report. If there are delays or issues identified by the COR, the Contractor shall provide monthly reports (available no later than ten calendar days after the end of the reporting month) instead of quarterly reports.

2.7. Prepare Annual Report: The Contractor shall submit an annual report summarizing the work accomplished in the contract at the end of each contract year (completion of option years, if exercised). This report shall include a description of the project overview, a description of all processes used to generate process information received by the Systems, documentation, and summary of all major deliverables during the report year. The annual report shall also include an estimate of “cost-to-complete” showing major tasks in order to evaluate resources for that year’s activities. This shall be submitted as part of Annual Report. The report is due within thirty (30) days before end of each contract year. The Contractor shall not have to provide an annual report at the end of Option Year 3 because a final report will be available (see Task 2.8).

2.8. Prepare Final Report: The Contractor shall submit a final report summarizing the work accomplished in the contract at the end of the contract year (completion of option years, if exercised). This report shall include a description of the project overview, a description of all processes used to generate process information received by the Systems, documentation, and summary of all major deliverables under the contract, user support, dissemination, recommendations for future efforts, and other issues as determined in conjunction with the COR. The report is due within thirty (30) days before end of last contract year.

2.8.1. The Contractor shall provide zip files (documents in native formats) for all deliverables for each performance year in an e-file and hard disk.

The Contractor shall submit the zip files when the final report is submitted. The files are due within thirty (30) days before end of last contract year.

3. Web Sites and Updated/Refresh Web Sites Releases

3.1. Both maintenance of the current Web site and development of new content language and functionality must follow AHRQ’s information systems security and privacy policies (See Section H.9). In addition, all aspects of the Web sites shall meet 508 compliance. The PSOPPC Web site is resident on the AHRQ cloud and the Contractor shall coordinate all relevant IT activities with AHRQ to provide these services, as necessary, with each releases and updates. The Contractor shall review web sites content and web functionality annually and update as necessary. The Contractor shall submit materials four (4) weeks before each release and finalize two (2) weeks after receiving comments from AHRQ upon COR approval.

3.2. The Contractor shall maintain and support the online system for PSOs to complete AHRQ’s PSO Profile Form via the secure PSOPPC portal.

PSOPPC and NPSD Systems Page 17 of 142

Forms are submitted on an annual basis. The Contractor shall maintain the PSO Profile Form records. Annual aggregate data from the PSO Profile Form shall be prepared for AHRQ quantitatively and graphically using a Data Analytic Interactive Dashboard (e.g., Tableau or similar COTS tool). However, the Contractor shall work with the COR in determining the first Data Analytic Interactive Dashboard layout three months prior to developing the final Data Analytic Interactive Dashboard.

The Contractor shall update the Data Analytic Interactive Dashboard with new PSO Profile information on an annual basis.

Standard Reports: The Contractor shall maintain functionality of the Web site that allows standard reports to be generated from PSO data previously submitted to the System as data. This includes data submission management reports which reflect submission activity. In addition, the system allows PSOs to run their own aggregate reports on data submitted. The Systems (when NPSD System is in production) will use the report and technical specifications developed for AHRQ’s Common Formats to build and maintain this functionality for PSOs. The Contractor shall follow the requirements of the Patient Safety Rule and security measures that prohibit PSOs from seeing other PSO’s data without authorization from the other PSO. Full details on the Patient Safety Rule can be found via AHRQ’s PSO Web site:

https://pso.ahrq.gov/legislation. The Contractor shall review and update the Standard Reports on a periodic basis (e.g., annual).

3.3. Maintain and Update/Upgrade/Refresh for PSOPPC and NPSD Systems:

The Contractor shall develop and implement upgrades to the Web sites to reflect revisions of the Common Formats, the PSO Profile Form, and any other relevant content. The Contractor shall add functionality to the website when deemed appropriate to reflect the activities of the Systems, with approval from the COR. The Contractor shall develop protocol(s) to address systems’ functionalities and log issues and resolutions. The Contractor shall conduct procedures for update/upgrade/refresh purposes. The Contractor shall schedule a periodic review and update of the protocols. First draft is available by first quarter after EDOC and submits to the COR. The Contractor shall draft and finalize four (4) weeks after receiving comments from AHRQ. The Contractor shall maintain an update/upgrade/refresh log of the Web sites, available to COR on a monthly basis.

3.4. NPSD System Conceptual Framework Development (Base Year only):

The Contractor shall develop a concept framework environment to house non-identifiable information (e.g., data embedded in table shells referenced in Tasks 13, 14, and 15) in the NPSD System. The Contractor shall provide strategies for building an innovative, agile, and flexible environment using the concept wireframe and make revisions, where applicable (Appendix B). The Contractor shall follow all IT requirements as defined in Section H. Some examples of IT requirements are application and system development (e.g., System Development Lifecycle), security and privacy, and publishing/branding requirements.

The Contractor shall seek approval from COR and AHRQ IT division in

PSOPPC and NPSD Systems Page 18 of 142 developing and maintaining (where applicable) the NPSD System. The Contractor shall finalize the conceptual design after obtaining approval from AHRQ. The Contractor shall allow ample time for AHRQ to review and provide comments e.g., at least two (2) weeks (Please note: This statement holds true for all documents in which AHRQ has to review and provide comments). The Contractor shall provide concept designs (e.g., diagrams, flowcharts) and any other relevant materials to support the proposed concept design to the COR. As part of the concept document, the Contractor shall provide recommendations addressing pros/cons for each strategy and the most feasible outcome/IT solution for AHRQ leadership to make the final determination/decision. Concept framework development must begin right after transition period has ended and be completed before development and testing begins – including two (2) weeks for AHRQ to review and provide comments.

3.5 Update NPSD System Framework (Base Year only): The Contractor shall revise the PSOPPC Web site to include NPSD page(s) and content (e.g., web link to the NPSD Web site). The Contractor shall review the wireframe content and design provided by the COR, update as necessary when the NPSD Web site is scheduled to Go-Live, and post updates.

(Please note: The Contractor shall make sure the content and website design look similar to the CAHPS Web site (http://www.ahrq.gov/cahps/index.html). The Contractor shall coordinate this effort with the COR and AHRQ Office of Communication Staff for final approval of a new NPSD Web site. A rough estimate of approximately 25% to 30% of the NPSD wireframe content would require revisions.

3.5.1 Publish NPSD Web Site (Optional Task):

Note: This optional task may be exercised once per year, in conjunction with the option exercise for Option Years 1, 2 and 3.

The Contractor shall develop some technical assistance materials (refer to Task 9) for public announcement in anticipation of the new NPSD Web site and learning materials to assist the PSOs in navigating and assessing the NPSD Web site (e.g., news article posting, Web site navigation materials, webinars). The Contractor shall implement the NPSD Web site and schedule for public publication (Go-Live). The NPSD Web site (Go Live) is scheduled to be published during Option Year 1, if sufficient meaningful data are available.

3.6 NPSD System Development and Testing (Base Year only): After the conceptual framework requirements (Task 3.4) and wireframe content (Task 3.5) have been approved by AHRQ, the Contractor shall begin IT system development and testing. Development and testing is scheduled to be completed by end of base year. The Contractor shall begin work on data analysis and fine tuning the analysis to be incorporated in the table shells, reports, dashboard (refer to Tasks 13, 14, and 15). The Contractor shall take approximately two (2) months to conduct data analytics, finalizing table shells, table contents (text report) along with discussions

PSOPPC and NPSD Systems Page 19 of 142 and determinations. (Please note: Refer to Tasks 13, 14, and 15 - as soon as data is made available, the Contractor shall develop materials (e.g., study plans, table shells) for AHRQ’s approval). Once the data/information (e.g., table shells) are finalized, the data/information are ready for public posting. The tasks related to the development of the data analytics of non-identifiable data, QDR and Effectiveness Strategies reports as referenced in Tasks 13, 14 and 15, which will begin as soon as sufficient non-identifiable data are available. The Contractor shall make sure ample time is allocated (e.g., for conducting data run/analysis, creating preliminary draft and finalizing data/reports, as well as accommodating iterative process (review, comments/feedback and revisions and clearance processes) for AHRQ staff.

3.6.1 The Contractor shall provide and submit protocols (Standard Operating Procedures) to address all aspects of Information Technology (IT) development, maintenance, update, and refresh.

Details of the PSOPPC and NPSD Web sites for maintenance, update, and refresh tasks are addressed in Task 3. The Contractor shall draft protocols two (2) weeks into the NPSD System development. Final protocols shall be received two (2) weeks after receiving comments from AHRQ.

3.7 NPSD System Operational (Optional Task):

Note: This optional task may be exercised once per year, in conjunction with the option exercise for either Option Years 1, 2 or 3.

Once data and information are ready for public posting on the NPSD System, the Contractor shall operationalize the NPSD System. This is a critical key milestone whereby once data are publicly available, AHRQ is required by the Patient Safety Act to submit a report to Congress within 18 months on effective strategies for reducing medical errors and increasing patient safety (refer to Task 15). The Contractor shall initiate the steps (e.g., website testing are completed, data are presentable in the format that has been approved by AHRQ) toward operationalizing the NPSD System scheduled to be published in Option Year 1.

4 Common Formats Maintenance and Upgrades: Within HHS, AHRQ leads the development of the Common Formats for patient safety event reporting. The Contractor shall provide assistance and support with the development of the content for the Common Formats. The Common Formats can be viewed at www.psoppc.org.

4.1 Maintenance of Current Common Formats: The Contractor shall maintain versioning and maintenance of the current Common Formats to include, but not limited to, supporting review of comments received and revision of the current version(s), any necessary technical edits to the reports and support materials (i.e., users guide, technical specifications – event descriptions, clinical notes, glossary, data dictionary, resource workbook, implementation guide, sample XML, flow chart), development of additional metadata attributes for the data elements, and revisions and upgrades to the technical specifications for the Common Formats. The

PSOPPC and NPSD Systems Page 20 of 142

Contractor shall review documents on an annual basis to make sure terminologies and definitions have not change over time (e.g., old terminologies have new meaning resulting in a change in the definitions/descriptions). All documents shall be 508 compliant. The Contractor shall review and update technical contents to the current Common Formats annually. The Contractor shall maintain a log for maintenance of Common Formats, available to the COR on a monthly basis.

4.2 Development of New Common Formats: In consultation with AHRQ, the

Contractor shall develop new Common Formats reports and support materials (i.e., user guide, technical specifications –clinical notes, glossary, data dictionary, resource workbook, implementation guide, sample XML) for the revised or new content area. AHRQ will develop predecessor documents: event descriptions and algorithms (flow charts).The Contractor shall prepare these documents for pre-publication work meetings (e.g., AHRQ’s Patient Safety Work Group), final publication (as announced in the Federal Register), and posting to the NQF Web site for stakeholder comments. Once comments are received from the National Quality Forum, and the NQF Expert Panel has prepared its feedback on the comments to AHRQ, the Contractor shall review, revise and develop any new content areas in consultation with AHRQ. All documents shall be 508 compliant. A rough estimate of approximately one (1) Common Format is anticipated for development and one (1) for revision per year.

4.3 Development of Metadata for the Common Formats and Transfer to

Metadata Registry: The Contractor shall maintain metadata for the Common Formats (both current and potential new content). The complete set of metadata for the Common Formats shall be maintained in a computerized system that allows entry, editing, and versioning of metadata attributes to provide document generation for and support development of AHRQ’s Common Formats. Working jointly with AHRQ, the Contractor shall determine which metadata attributes will be included in the content displayed at the United States Health Information Knowledgebase (USHIK). The Contractor shall coordinate metadata activities with the USHIK Contractor and transfer of metadata to USHIK with new releases of the Common Formats. Current information can be found at: https://ushik.ahrq.gov/mdr/portals. All documents shall be 508 compliant. The Contractor shall develop a project management timeline/milestone (e.g., IMS) and schedule work for developing, maintaining, and submitting/transferring metadata to Registry on an annual basis.

4.4 Health Level Seven (HL-7) Activities: The Contractor shall perform activities related to HL-7 and the Common Formats. Examples of such activities shall include preparation of documents/materials for ballot routing or documents related to the file transfer protocol, such as the current Implementation Guide. First draft available three (3) weeks after identifying needs. The Contractor shall finalize materials two (2) weeks after receiving comments from AHRQ. The Contractor shall be

PSOPPC and NPSD Systems Page 21 of 142 responsible for making sure the HL-7 version AHRQ is using meets industry standards and all Federal regulations (http://www.hhs.gov/hipaa/for-professionals/special-topics/HITECH-act-enforcement-interim-final-rule/index.html). Current industry standards for the exchange, integration, sharing, and retrieval of electronic health information that supports clinical practice and the management, delivery and evaluation of health services is HL- 7. However if current practice changes or evolve, the Contractor shall maintain and update current practice to reflect nuances in the Health Information Technology for Economic and Clinical Health (HITECH) (e.g., electronic medical records, meaningful use) industry. The Contractor shall conduct periodic assessment of all HL activities in a log (e.g., monthly) and submit to the COR. The Contractor shall document changes and propose recommendations for changes to the COR. Final COR approval shall be obtained before changes are made.

4.5 Technical Specifications (TS) Support: The Contractor shall receive and track comments related to the Common Formats technical specifications.

In addition, the Contractor shall maintain a service…